contrib/unbound/validator/validator.c

   1 /*
   2  * validator/validator.c - secure validator DNS query response module
   3  *
   4  * Copyright (c) 2007, NLnet Labs. All rights reserved.
   5  *
   6  * This software is open source.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * Redistributions of source code must retain the above copyright notice,
  13  * this list of conditions and the following disclaimer.
  14  *
  15  * Redistributions in binary form must reproduce the above copyright notice,
  16  * this list of conditions and the following disclaimer in the documentation
  17  * and/or other materials provided with the distribution.
  18  *
  19  * Neither the name of the NLNET LABS nor the names of its contributors may
  20  * be used to endorse or promote products derived from this software without
  21  * specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
  29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  34  */
  35
  36 /**
  37  * \file
  38  *
  39  * This file contains a module that performs validation of DNS queries.
  40  * According to RFC 4034.
  41  */
  42 #include "config.h"
  43 #include "validator/validator.h"
  44 #include "validator/val_anchor.h"
  45 #include "validator/val_kcache.h"
  46 #include "validator/val_kentry.h"
  47 #include "validator/val_utils.h"
  48 #include "validator/val_nsec.h"
  49 #include "validator/val_nsec3.h"
  50 #include "validator/val_neg.h"
  51 #include "validator/val_sigcrypt.h"
  52 #include "validator/autotrust.h"
  53 #include "services/cache/dns.h"
  54 #include "util/data/dname.h"
  55 #include "util/module.h"
  56 #include "util/log.h"
  57 #include "util/net_help.h"
  58 #include "util/regional.h"
  59 #include "util/config_file.h"
  60 #include "util/fptr_wlist.h"
  61 #include "ldns/rrdef.h"
  62 #include "ldns/wire2str.h"
  63
  64 /* forward decl for cache response and normal super inform calls of a DS */
  65 static void process_ds_response(struct module_qstate* qstate,
  66         struct val_qstate* vq, int id, int rcode, struct dns_msg* msg,
  67         struct query_info* qinfo, struct sock_list* origin);
  68
  69 /** fill up nsec3 key iterations config entry */
  70 static int
  71 fill_nsec3_iter(struct val_env* ve, char* s, int c)
  72 {
  73         char* e;
  74         int i;
  75         free(ve->nsec3_keysize);
  76         free(ve->nsec3_maxiter);
  77         ve->nsec3_keysize = (size_t*)calloc(sizeof(size_t), (size_t)c);
  78         ve->nsec3_maxiter = (size_t*)calloc(sizeof(size_t), (size_t)c);
  79         if(!ve->nsec3_keysize || !ve->nsec3_maxiter) {
  80                 log_err("out of memory");
  81                 return 0;
  82         }
  83         for(i=0; i<c; i++) {
  84                 ve->nsec3_keysize[i] = (size_t)strtol(s, &e, 10);
  85                 if(s == e) {
  86                         log_err("cannot parse: %s", s);
  87                         return 0;
  88                 }
  89                 s = e;
  90                 ve->nsec3_maxiter[i] = (size_t)strtol(s, &e, 10);
  91                 if(s == e) {
  92                         log_err("cannot parse: %s", s);
  93                         return 0;
  94                 }
  95                 s = e;
  96                 if(i>0 && ve->nsec3_keysize[i-1] >= ve->nsec3_keysize[i]) {
  97                         log_err("nsec3 key iterations not ascending: %d %d",
  98                                 (int)ve->nsec3_keysize[i-1],
  99                                 (int)ve->nsec3_keysize[i]);
 100                         return 0;
 101                 }
 102                 verbose(VERB_ALGO, "validator nsec3cfg keysz %d mxiter %d",
 103                         (int)ve->nsec3_keysize[i], (int)ve->nsec3_maxiter[i]);
 104         }
 105         return 1;
 106 }
 107
 108 /** apply config settings to validator */
 109 static int
 110 val_apply_cfg(struct module_env* env, struct val_env* val_env,
 111         struct config_file* cfg)
 112 {
 113         int c;
 114         val_env->bogus_ttl = (uint32_t)cfg->bogus_ttl;
 115         val_env->clean_additional = cfg->val_clean_additional;
 116         val_env->permissive_mode = cfg->val_permissive_mode;
 117         if(!env->anchors)
 118                 env->anchors = anchors_create();
 119         if(!env->anchors) {
 120                 log_err("out of memory");
 121                 return 0;
 122         }
 123         if(!val_env->kcache)
 124                 val_env->kcache = key_cache_create(cfg);
 125         if(!val_env->kcache) {
 126                 log_err("out of memory");
 127                 return 0;
 128         }
 129         env->key_cache = val_env->kcache;
 130         if(!anchors_apply_cfg(env->anchors, cfg)) {
 131                 log_err("validator: error in trustanchors config");
 132                 return 0;
 133         }
 134         val_env->date_override = cfg->val_date_override;
 135         val_env->skew_min = cfg->val_sig_skew_min;
 136         val_env->skew_max = cfg->val_sig_skew_max;
 137         c = cfg_count_numbers(cfg->val_nsec3_key_iterations);
 138         if(c < 1 || (c&1)) {
 139                 log_err("validator: unparseable or odd nsec3 key "
 140                         "iterations: %s", cfg->val_nsec3_key_iterations);
 141                 return 0;
 142         }
 143         val_env->nsec3_keyiter_count = c/2;
 144         if(!fill_nsec3_iter(val_env, cfg->val_nsec3_key_iterations, c/2)) {
 145                 log_err("validator: cannot apply nsec3 key iterations");
 146                 return 0;
 147         }
 148         if(!val_env->neg_cache)
 149                 val_env->neg_cache = val_neg_create(cfg,
 150                         val_env->nsec3_maxiter[val_env->nsec3_keyiter_count-1]);
 151         if(!val_env->neg_cache) {
 152                 log_err("out of memory");
 153                 return 0;
 154         }
 155         env->neg_cache = val_env->neg_cache;
 156         return 1;
 157 }
 158
 159 int
 160 val_init(struct module_env* env, int id)
 161 {
 162         struct val_env* val_env = (struct val_env*)calloc(1,
 163                 sizeof(struct val_env));
 164         if(!val_env) {
 165                 log_err("malloc failure");
 166                 return 0;
 167         }
 168         env->modinfo[id] = (void*)val_env;
 169         env->need_to_validate = 1;
 170         val_env->permissive_mode = 0;
 171         lock_basic_init(&val_env->bogus_lock);
 172         lock_protect(&val_env->bogus_lock, &val_env->num_rrset_bogus,
 173                 sizeof(val_env->num_rrset_bogus));
 174         if(!val_apply_cfg(env, val_env, env->cfg)) {
 175                 log_err("validator: could not apply configuration settings.");
 176                 return 0;
 177         }
 178         return 1;
 179 }
 180
 181 void
 182 val_deinit(struct module_env* env, int id)
 183 {
 184         struct val_env* val_env;
 185         if(!env || !env->modinfo[id])
 186                 return;
 187         val_env = (struct val_env*)env->modinfo[id];
 188         lock_basic_destroy(&val_env->bogus_lock);
 189         anchors_delete(env->anchors);
 190         env->anchors = NULL;
 191         key_cache_delete(val_env->kcache);
 192         neg_cache_delete(val_env->neg_cache);
 193         free(val_env->nsec3_keysize);
 194         free(val_env->nsec3_maxiter);
 195         free(val_env);
 196         env->modinfo[id] = NULL;
 197 }
 198
 199 /** fill in message structure */
 200 static struct val_qstate*
 201 val_new_getmsg(struct module_qstate* qstate, struct val_qstate* vq)
 202 {
 203         if(!qstate->return_msg || qstate->return_rcode != LDNS_RCODE_NOERROR) {
 204                 /* create a message to verify */
 205                 verbose(VERB_ALGO, "constructing reply for validation");
 206                 vq->orig_msg = (struct dns_msg*)regional_alloc(qstate->region,
 207                         sizeof(struct dns_msg));
 208                 if(!vq->orig_msg)
 209                         return NULL;
 210                 vq->orig_msg->qinfo = qstate->qinfo;
 211                 vq->orig_msg->rep = (struct reply_info*)regional_alloc(
 212                         qstate->region, sizeof(struct reply_info));
 213                 if(!vq->orig_msg->rep)
 214                         return NULL;
 215                 memset(vq->orig_msg->rep, 0, sizeof(struct reply_info));
 216                 vq->orig_msg->rep->flags = (uint16_t)(qstate->return_rcode&0xf)
 217                         |BIT_QR|BIT_RA|(qstate->query_flags|(BIT_CD|BIT_RD));
 218                 vq->orig_msg->rep->qdcount = 1;
 219         } else {
 220                 vq->orig_msg = qstate->return_msg;
 221         }
 222         vq->qchase = qstate->qinfo;
 223         /* chase reply will be an edited (sub)set of the orig msg rrset ptrs */
 224         vq->chase_reply = regional_alloc_init(qstate->region,
 225                 vq->orig_msg->rep,
 226                 sizeof(struct reply_info) - sizeof(struct rrset_ref));
 227         if(!vq->chase_reply)
 228                 return NULL;
 229         vq->chase_reply->rrsets = regional_alloc_init(qstate->region,
 230                 vq->orig_msg->rep->rrsets, sizeof(struct ub_packed_rrset_key*)
 231                         * vq->orig_msg->rep->rrset_count);
 232         if(!vq->chase_reply->rrsets)
 233                 return NULL;
 234         vq->rrset_skip = 0;
 235         return vq;
 236 }
 237
 238 /** allocate new validator query state */
 239 static struct val_qstate*
 240 val_new(struct module_qstate* qstate, int id)
 241 {
 242         struct val_qstate* vq = (struct val_qstate*)regional_alloc(
 243                 qstate->region, sizeof(*vq));
 244         log_assert(!qstate->minfo[id]);
 245         if(!vq)
 246                 return NULL;
 247         memset(vq, 0, sizeof(*vq));
 248         qstate->minfo[id] = vq;
 249         vq->state = VAL_INIT_STATE;
 250         return val_new_getmsg(qstate, vq);
 251 }
 252
 253 /**
 254  * Exit validation with an error status
 255  *
 256  * @param qstate: query state
 257  * @param id: validator id.
 258  * @return false, for use by caller to return to stop processing.
 259  */
 260 static int
 261 val_error(struct module_qstate* qstate, int id)
 262 {
 263         qstate->ext_state[id] = module_error;
 264         qstate->return_rcode = LDNS_RCODE_SERVFAIL;
 265         return 0;
 266 }
 267
 268 /**
 269  * Check to see if a given response needs to go through the validation
 270  * process. Typical reasons for this routine to return false are: CD bit was
 271  * on in the original request, or the response is a kind of message that
 272  * is unvalidatable (i.e., SERVFAIL, REFUSED, etc.)
 273  *
 274  * @param qstate: query state.
 275  * @param ret_rc: rcode for this message (if noerror - examine ret_msg).
 276  * @param ret_msg: return msg, can be NULL; look at rcode instead.
 277  * @return true if the response could use validation (although this does not
 278  *         mean we can actually validate this response).
 279  */
 280 static int
 281 needs_validation(struct module_qstate* qstate, int ret_rc,
 282         struct dns_msg* ret_msg)
 283 {
 284         int rcode;
 285
 286         /* If the CD bit is on in the original request, then you could think
 287          * that we don't bother to validate anything.
 288          * But this is signalled internally with the valrec flag.
 289          * User queries are validated with BIT_CD to make our cache clean
 290          * so that bogus messages get retried by the upstream also for
 291          * downstream validators that set BIT_CD.
 292          * For DNS64 bit_cd signals no dns64 processing, but we want to
 293          * provide validation there too */
 294         /*
 295         if(qstate->query_flags & BIT_CD) {
 296                 verbose(VERB_ALGO, "not validating response due to CD bit");
 297                 return 0;
 298         }
 299         */
 300         if(qstate->is_valrec) {
 301                 verbose(VERB_ALGO, "not validating response, is valrec"
 302                         "(validation recursion lookup)");
 303                 return 0;
 304         }
 305
 306         if(ret_rc != LDNS_RCODE_NOERROR || !ret_msg)
 307                 rcode = ret_rc;
 308         else    rcode = (int)FLAGS_GET_RCODE(ret_msg->rep->flags);
 309
 310         if(rcode != LDNS_RCODE_NOERROR && rcode != LDNS_RCODE_NXDOMAIN) {
 311                 if(verbosity >= VERB_ALGO) {
 312                         char rc[16];
 313                         rc[0]=0;
 314                         (void)sldns_wire2str_rcode_buf(rcode, rc, sizeof(rc));
 315                         verbose(VERB_ALGO, "cannot validate non-answer, rcode %s", rc);
 316                 }
 317                 return 0;
 318         }
 319
 320         /* cannot validate positive RRSIG response. (negatives can) */
 321         if(qstate->qinfo.qtype == LDNS_RR_TYPE_RRSIG &&
 322                 rcode == LDNS_RCODE_NOERROR && ret_msg &&
 323                 ret_msg->rep->an_numrrsets > 0) {
 324                 verbose(VERB_ALGO, "cannot validate RRSIG, no sigs on sigs.");
 325                 return 0;
 326         }
 327         return 1;
 328 }
 329
 330 /**
 331  * Check to see if the response has already been validated.
 332  * @param ret_msg: return msg, can be NULL
 333  * @return true if the response has already been validated
 334  */
 335 static int
 336 already_validated(struct dns_msg* ret_msg)
 337 {
 338         /* validate unchecked, and re-validate bogus messages */
 339         if (ret_msg && ret_msg->rep->security > sec_status_bogus)
 340         {
 341                 verbose(VERB_ALGO, "response has already been validated: %s",
 342                         sec_status_to_string(ret_msg->rep->security));
 343                 return 1;
 344         }
 345         return 0;
 346 }
 347
 348 /**
 349  * Generate a request for DNS data.
 350  *
 351  * @param qstate: query state that is the parent.
 352  * @param id: module id.
 353  * @param name: what name to query for.
 354  * @param namelen: length of name.
 355  * @param qtype: query type.
 356  * @param qclass: query class.
 357  * @param flags: additional flags, such as the CD bit (BIT_CD), or 0.
 358  * @return false on alloc failure.
 359  */
 360 static int
 361 generate_request(struct module_qstate* qstate, int id, uint8_t* name,
 362         size_t namelen, uint16_t qtype, uint16_t qclass, uint16_t flags)
 363 {
 364         struct val_qstate* vq = (struct val_qstate*)qstate->minfo[id];
 365         struct module_qstate* newq;
 366         struct query_info ask;
 367         int valrec;
 368         ask.qname = name;
 369         ask.qname_len = namelen;
 370         ask.qtype = qtype;
 371         ask.qclass = qclass;
 372         log_query_info(VERB_ALGO, "generate request", &ask);
 373         fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
 374         /* enable valrec flag to avoid recursion to the same validation
 375          * routine, this lookup is simply a lookup. DLVs need validation */
 376         if(qtype == LDNS_RR_TYPE_DLV)
 377                 valrec = 0;
 378         else valrec = 1;
 379         if(!(*qstate->env->attach_sub)(qstate, &ask,
 380                 (uint16_t)(BIT_RD|flags), 0, valrec, &newq)){
 381                 log_err("Could not generate request: out of memory");
 382                 return 0;
 383         }
 384         /* newq; validator does not need state created for that
 385          * query, and its a 'normal' for iterator as well */
 386         if(newq) {
 387                 /* add our blacklist to the query blacklist */
 388                 sock_list_merge(&newq->blacklist, newq->region,
 389                         vq->chain_blacklist);
 390         }
 391         qstate->ext_state[id] = module_wait_subquery;
 392         return 1;
 393 }
 394
 395 /**
 396  * Prime trust anchor for use.
 397  * Generate and dispatch a priming query for the given trust anchor.
 398  * The trust anchor can be DNSKEY or DS and does not have to be signed.
 399  *
 400  * @param qstate: query state.
 401  * @param vq: validator query state.
 402  * @param id: module id.
 403  * @param toprime: what to prime.
 404  * @return false on a processing error.
 405  */
 406 static int
 407 prime_trust_anchor(struct module_qstate* qstate, struct val_qstate* vq,
 408         int id, struct trust_anchor* toprime)
 409 {
 410         int ret = generate_request(qstate, id, toprime->name, toprime->namelen,
 411                 LDNS_RR_TYPE_DNSKEY, toprime->dclass, BIT_CD);
 412         if(!ret) {
 413                 log_err("Could not prime trust anchor: out of memory");
 414                 return 0;
 415         }
 416         /* ignore newq; validator does not need state created for that
 417          * query, and its a 'normal' for iterator as well */
 418         vq->wait_prime_ta = 1; /* to elicit PRIME_RESP_STATE processing
 419                 from the validator inform_super() routine */
 420         /* store trust anchor name for later lookup when prime returns */
 421         vq->trust_anchor_name = regional_alloc_init(qstate->region,
 422                 toprime->name, toprime->namelen);
 423         vq->trust_anchor_len = toprime->namelen;
 424         vq->trust_anchor_labs = toprime->namelabs;
 425         if(!vq->trust_anchor_name) {
 426                 log_err("Could not prime trust anchor: out of memory");
 427                 return 0;
 428         }
 429         return 1;
 430 }
 431
 432 /**
 433  * Validate if the ANSWER and AUTHORITY sections contain valid rrsets.
 434  * They must be validly signed with the given key.
 435  * Tries to validate ADDITIONAL rrsets as well, but only to check them.
 436  * Allows unsigned CNAME after a DNAME that expands the DNAME.
 437  *
 438  * Note that by the time this method is called, the process of finding the
 439  * trusted DNSKEY rrset that signs this response must already have been
 440  * completed.
 441  *
 442  * @param qstate: query state.
 443  * @param env: module env for verify.
 444  * @param ve: validator env for verify.
 445  * @param qchase: query that was made.
 446  * @param chase_reply: answer to validate.
 447  * @param key_entry: the key entry, which is trusted, and which matches
 448  *      the signer of the answer. The key entry isgood().
 449  * @return false if any of the rrsets in the an or ns sections of the message
 450  *      fail to verify. The message is then set to bogus.
 451  */
 452 static int
 453 validate_msg_signatures(struct module_qstate* qstate, struct module_env* env,
 454         struct val_env* ve, struct query_info* qchase,
 455         struct reply_info* chase_reply, struct key_entry_key* key_entry)
 456 {
 457         uint8_t* sname;
 458         size_t i, slen;
 459         struct ub_packed_rrset_key* s;
 460         enum sec_status sec;
 461         int dname_seen = 0;
 462         char* reason = NULL;
 463
 464         /* validate the ANSWER section */
 465         for(i=0; i<chase_reply->an_numrrsets; i++) {
 466                 s = chase_reply->rrsets[i];
 467                 /* Skip the CNAME following a (validated) DNAME.
 468                  * Because of the normalization routines in the iterator,
 469                  * there will always be an unsigned CNAME following a DNAME
 470                  * (unless qtype=DNAME). */
 471                 if(dname_seen && ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME) {
 472                         dname_seen = 0;
 473                         /* CNAME was synthesized by our own iterator */
 474                         /* since the DNAME verified, mark the CNAME as secure */
 475                         ((struct packed_rrset_data*)s->entry.data)->security =
 476                                 sec_status_secure;
 477                         ((struct packed_rrset_data*)s->entry.data)->trust =
 478                                 rrset_trust_validated;
 479                         continue;
 480                 }
 481
 482                 /* Verify the answer rrset */
 483                 sec = val_verify_rrset_entry(env, ve, s, key_entry, &reason);
 484                 /* If the (answer) rrset failed to validate, then this
 485                  * message is BAD. */
 486                 if(sec != sec_status_secure) {
 487                         log_nametypeclass(VERB_QUERY, "validator: response "
 488                                 "has failed ANSWER rrset:", s->rk.dname,
 489                                 ntohs(s->rk.type), ntohs(s->rk.rrset_class));
 490                         errinf(qstate, reason);
 491                         if(ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME)
 492                                 errinf(qstate, "for CNAME");
 493                         else if(ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME)
 494                                 errinf(qstate, "for DNAME");
 495                         errinf_origin(qstate, qstate->reply_origin);
 496                         chase_reply->security = sec_status_bogus;
 497                         return 0;
 498                 }
 499
 500                 /* Notice a DNAME that should be followed by an unsigned
 501                  * CNAME. */
 502                 if(qchase->qtype != LDNS_RR_TYPE_DNAME &&
 503                         ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME) {
 504                         dname_seen = 1;
 505                 }
 506         }
 507
 508         /* validate the AUTHORITY section */
 509         for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
 510                 chase_reply->ns_numrrsets; i++) {
 511                 s = chase_reply->rrsets[i];
 512                 sec = val_verify_rrset_entry(env, ve, s, key_entry, &reason);
 513                 /* If anything in the authority section fails to be secure,
 514                  * we have a bad message. */
 515                 if(sec != sec_status_secure) {
 516                         log_nametypeclass(VERB_QUERY, "validator: response "
 517                                 "has failed AUTHORITY rrset:", s->rk.dname,
 518                                 ntohs(s->rk.type), ntohs(s->rk.rrset_class));
 519                         errinf(qstate, reason);
 520                         errinf_rrset(qstate, s);
 521                         errinf_origin(qstate, qstate->reply_origin);
 522                         chase_reply->security = sec_status_bogus;
 523                         return 0;
 524                 }
 525         }
 526
 527         /* attempt to validate the ADDITIONAL section rrsets */
 528         if(!ve->clean_additional)
 529                 return 1;
 530         for(i=chase_reply->an_numrrsets+chase_reply->ns_numrrsets;
 531                 i<chase_reply->rrset_count; i++) {
 532                 s = chase_reply->rrsets[i];
 533                 /* only validate rrs that have signatures with the key */
 534                 /* leave others unchecked, those get removed later on too */
 535                 val_find_rrset_signer(s, &sname, &slen);
 536                 if(sname && query_dname_compare(sname, key_entry->name)==0)
 537                         (void)val_verify_rrset_entry(env, ve, s, key_entry,
 538                                 &reason);
 539                 /* the additional section can fail to be secure,
 540                  * it is optional, check signature in case we need
 541                  * to clean the additional section later. */
 542         }
 543
 544         return 1;
 545 }
 546
 547 /**
 548  * Detect wrong truncated response (say from BIND 9.6.1 that is forwarding
 549  * and saw the NS record without signatures from a referral).
 550  * The positive response has a mangled authority section.
 551  * Remove that authority section and the additional section.
 552  * @param rep: reply
 553  * @return true if a wrongly truncated response.
 554  */
 555 static int
 556 detect_wrongly_truncated(struct reply_info* rep)
 557 {
 558         size_t i;
 559         /* only NS in authority, and it is bogus */
 560         if(rep->ns_numrrsets != 1 || rep->an_numrrsets == 0)
 561                 return 0;
 562         if(ntohs(rep->rrsets[ rep->an_numrrsets ]->rk.type) != LDNS_RR_TYPE_NS)
 563                 return 0;
 564         if(((struct packed_rrset_data*)rep->rrsets[ rep->an_numrrsets ]
 565                 ->entry.data)->security == sec_status_secure)
 566                 return 0;
 567         /* answer section is present and secure */
 568         for(i=0; i<rep->an_numrrsets; i++) {
 569                 if(((struct packed_rrset_data*)rep->rrsets[ i ]
 570                         ->entry.data)->security != sec_status_secure)
 571                         return 0;
 572         }
 573         verbose(VERB_ALGO, "truncating to minimal response");
 574         return 1;
 575 }
 576
 577 /**
 578  * For messages that are not referrals, if the chase reply contains an
 579  * unsigned NS record in the authority section it could have been
 580  * inserted by a (BIND) forwarder that thinks the zone is insecure, and
 581  * that has an NS record without signatures in cache.  Remove the NS
 582  * record since the reply does not hinge on that record (in the authority
 583  * section), but do not remove it if it removes the last record from the
 584  * answer+authority sections.
 585  * @param chase_reply: the chased reply, we have a key for this contents,
 586  *      so we should have signatures for these rrsets and not having
 587  *      signatures means it will be bogus.
 588  * @param orig_reply: original reply, remove NS from there as well because
 589  *      we cannot mark the NS record as DNSSEC valid because it is not
 590  *      validated by signatures.
 591  */
 592 static void
 593 remove_spurious_authority(struct reply_info* chase_reply,
 594         struct reply_info* orig_reply)
 595 {
 596         size_t i, found = 0;
 597         int remove = 0;
 598         /* if no answer and only 1 auth RRset, do not remove that one */
 599         if(chase_reply->an_numrrsets == 0 && chase_reply->ns_numrrsets == 1)
 600                 return;
 601         /* search authority section for unsigned NS records */
 602         for(i = chase_reply->an_numrrsets;
 603                 i < chase_reply->an_numrrsets+chase_reply->ns_numrrsets; i++) {
 604                 struct packed_rrset_data* d = (struct packed_rrset_data*)
 605                         chase_reply->rrsets[i]->entry.data;
 606                 if(ntohs(chase_reply->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS
 607                         && d->rrsig_count == 0) {
 608                         found = i;
 609                         remove = 1;
 610                         break;
 611                 }
 612         }
 613         /* see if we found the entry */
 614         if(!remove) return;
 615         log_rrset_key(VERB_ALGO, "Removing spurious unsigned NS record "
 616                 "(likely inserted by forwarder)", chase_reply->rrsets[found]);
 617
 618         /* find rrset in orig_reply */
 619         for(i = orig_reply->an_numrrsets;
 620                 i < orig_reply->an_numrrsets+orig_reply->ns_numrrsets; i++) {
 621                 if(ntohs(orig_reply->rrsets[i]->rk.type) == LDNS_RR_TYPE_NS
 622                         && query_dname_compare(orig_reply->rrsets[i]->rk.dname,
 623                                 chase_reply->rrsets[found]->rk.dname) == 0) {
 624                         /* remove from orig_msg */
 625                         val_reply_remove_auth(orig_reply, i);
 626                         break;
 627                 }
 628         }
 629         /* remove rrset from chase_reply */
 630         val_reply_remove_auth(chase_reply, found);
 631 }
 632
 633 /**
 634  * Given a "positive" response -- a response that contains an answer to the
 635  * question, and no CNAME chain, validate this response.
 636  *
 637  * The answer and authority RRsets must already be verified as secure.
 638  *
 639  * @param env: module env for verify.
 640  * @param ve: validator env for verify.
 641  * @param qchase: query that was made.
 642  * @param chase_reply: answer to that query to validate.
 643  * @param kkey: the key entry, which is trusted, and which matches
 644  *      the signer of the answer. The key entry isgood().
 645  */
 646 static void
 647 validate_positive_response(struct module_env* env, struct val_env* ve,
 648         struct query_info* qchase, struct reply_info* chase_reply,
 649         struct key_entry_key* kkey)
 650 {
 651         uint8_t* wc = NULL;
 652         int wc_NSEC_ok = 0;
 653         int nsec3s_seen = 0;
 654         size_t i;
 655         struct ub_packed_rrset_key* s;
 656
 657         /* validate the ANSWER section - this will be the answer itself */
 658         for(i=0; i<chase_reply->an_numrrsets; i++) {
 659                 s = chase_reply->rrsets[i];
 660
 661                 /* Check to see if the rrset is the result of a wildcard
 662                  * expansion. If so, an additional check will need to be
 663                  * made in the authority section. */
 664                 if(!val_rrset_wildcard(s, &wc)) {
 665                         log_nametypeclass(VERB_QUERY, "Positive response has "
 666                                 "inconsistent wildcard sigs:", s->rk.dname,
 667                                 ntohs(s->rk.type), ntohs(s->rk.rrset_class));
 668                         chase_reply->security = sec_status_bogus;
 669                         return;
 670                 }
 671         }
 672
 673         /* validate the AUTHORITY section as well - this will generally be
 674          * the NS rrset (which could be missing, no problem) */
 675         for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
 676                 chase_reply->ns_numrrsets; i++) {
 677                 s = chase_reply->rrsets[i];
 678
 679                 /* If this is a positive wildcard response, and we have a
 680                  * (just verified) NSEC record, try to use it to 1) prove
 681                  * that qname doesn't exist and 2) that the correct wildcard
 682                  * was used. */
 683                 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
 684                         if(val_nsec_proves_positive_wildcard(s, qchase, wc)) {
 685                                 wc_NSEC_ok = 1;
 686                         }
 687                         /* if not, continue looking for proof */
 688                 }
 689
 690                 /* Otherwise, if this is a positive wildcard response and
 691                  * we have NSEC3 records */
 692                 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
 693                         nsec3s_seen = 1;
 694                 }
 695         }
 696
 697         /* If this was a positive wildcard response that we haven't already
 698          * proven, and we have NSEC3 records, try to prove it using the NSEC3
 699          * records. */
 700         if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) {
 701                 enum sec_status sec = nsec3_prove_wildcard(env, ve,
 702                         chase_reply->rrsets+chase_reply->an_numrrsets,
 703                         chase_reply->ns_numrrsets, qchase, kkey, wc);
 704                 if(sec == sec_status_insecure) {
 705                         verbose(VERB_ALGO, "Positive wildcard response is "
 706                                 "insecure");
 707                         chase_reply->security = sec_status_insecure;
 708                         return;
 709                 } else if(sec == sec_status_secure)
 710                         wc_NSEC_ok = 1;
 711         }
 712
 713         /* If after all this, we still haven't proven the positive wildcard
 714          * response, fail. */
 715         if(wc != NULL && !wc_NSEC_ok) {
 716                 verbose(VERB_QUERY, "positive response was wildcard "
 717                         "expansion and did not prove original data "
 718                         "did not exist");
 719                 chase_reply->security = sec_status_bogus;
 720                 return;
 721         }
 722
 723         verbose(VERB_ALGO, "Successfully validated positive response");
 724         chase_reply->security = sec_status_secure;
 725 }
 726
 727 /**
 728  * Validate a NOERROR/NODATA signed response -- a response that has a
 729  * NOERROR Rcode but no ANSWER section RRsets. This consists of making
 730  * certain that the authority section NSEC/NSEC3s proves that the qname
 731  * does exist and the qtype doesn't.
 732  *
 733  * The answer and authority RRsets must already be verified as secure.
 734  *
 735  * @param env: module env for verify.
 736  * @param ve: validator env for verify.
 737  * @param qchase: query that was made.
 738  * @param chase_reply: answer to that query to validate.
 739  * @param kkey: the key entry, which is trusted, and which matches
 740  *      the signer of the answer. The key entry isgood().
 741  */
 742 static void
 743 validate_nodata_response(struct module_env* env, struct val_env* ve,
 744         struct query_info* qchase, struct reply_info* chase_reply,
 745         struct key_entry_key* kkey)
 746 {
 747         /* Since we are here, there must be nothing in the ANSWER section to
 748          * validate. */
 749         /* (Note: CNAME/DNAME responses will not directly get here --
 750          * instead, they are chased down into indiviual CNAME validations,
 751          * and at the end of the cname chain a POSITIVE, or CNAME_NOANSWER
 752          * validation.) */
 753
 754         /* validate the AUTHORITY section */
 755         int has_valid_nsec = 0; /* If true, then the NODATA has been proven.*/
 756         uint8_t* ce = NULL; /* for wildcard nodata responses. This is the
 757                                 proven closest encloser. */
 758         uint8_t* wc = NULL; /* for wildcard nodata responses. wildcard nsec */
 759         int nsec3s_seen = 0; /* nsec3s seen */
 760         struct ub_packed_rrset_key* s;
 761         size_t i;
 762
 763         for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
 764                 chase_reply->ns_numrrsets; i++) {
 765                 s = chase_reply->rrsets[i];
 766                 /* If we encounter an NSEC record, try to use it to prove
 767                  * NODATA.
 768                  * This needs to handle the ENT NODATA case. */
 769                 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
 770                         if(nsec_proves_nodata(s, qchase, &wc)) {
 771                                 has_valid_nsec = 1;
 772                                 /* sets wc-encloser if wildcard applicable */
 773                         }
 774                         if(val_nsec_proves_name_error(s, qchase->qname)) {
 775                                 ce = nsec_closest_encloser(qchase->qname, s);
 776                         }
 777                         if(val_nsec_proves_insecuredelegation(s, qchase)) {
 778                                 verbose(VERB_ALGO, "delegation is insecure");
 779                                 chase_reply->security = sec_status_insecure;
 780                                 return;
 781                         }
 782                 } else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
 783                         nsec3s_seen = 1;
 784                 }
 785         }
 786
 787         /* check to see if we have a wildcard NODATA proof. */
 788
 789         /* The wildcard NODATA is 1 NSEC proving that qname does not exist
 790          * (and also proving what the closest encloser is), and 1 NSEC
 791          * showing the matching wildcard, which must be *.closest_encloser. */
 792         if(wc && !ce)
 793                 has_valid_nsec = 0;
 794         else if(wc && ce) {
 795                 if(query_dname_compare(wc, ce) != 0) {
 796                         has_valid_nsec = 0;
 797                 }
 798         }
 799
 800         if(!has_valid_nsec && nsec3s_seen) {
 801                 enum sec_status sec = nsec3_prove_nodata(env, ve,
 802                         chase_reply->rrsets+chase_reply->an_numrrsets,
 803                         chase_reply->ns_numrrsets, qchase, kkey);
 804                 if(sec == sec_status_insecure) {
 805                         verbose(VERB_ALGO, "NODATA response is insecure");
 806                         chase_reply->security = sec_status_insecure;
 807                         return;
 808                 } else if(sec == sec_status_secure)
 809                         has_valid_nsec = 1;
 810         }
 811
 812         if(!has_valid_nsec) {
 813                 verbose(VERB_QUERY, "NODATA response failed to prove NODATA "
 814                         "status with NSEC/NSEC3");
 815                 if(verbosity >= VERB_ALGO)
 816                         log_dns_msg("Failed NODATA", qchase, chase_reply);
 817                 chase_reply->security = sec_status_bogus;
 818                 return;
 819         }
 820
 821         verbose(VERB_ALGO, "successfully validated NODATA response.");
 822         chase_reply->security = sec_status_secure;
 823 }
 824
 825 /**
 826  * Validate a NAMEERROR signed response -- a response that has a NXDOMAIN
 827  * Rcode.
 828  * This consists of making certain that the authority section NSEC proves
 829  * that the qname doesn't exist and the covering wildcard also doesn't exist..
 830  *
 831  * The answer and authority RRsets must have already been verified as secure.
 832  *
 833  * @param env: module env for verify.
 834  * @param ve: validator env for verify.
 835  * @param qchase: query that was made.
 836  * @param chase_reply: answer to that query to validate.
 837  * @param kkey: the key entry, which is trusted, and which matches
 838  *      the signer of the answer. The key entry isgood().
 839  * @param rcode: adjusted RCODE, in case of RCODE/proof mismatch leniency.
 840  */
 841 static void
 842 validate_nameerror_response(struct module_env* env, struct val_env* ve,
 843         struct query_info* qchase, struct reply_info* chase_reply,
 844         struct key_entry_key* kkey, int* rcode)
 845 {
 846         int has_valid_nsec = 0;
 847         int has_valid_wnsec = 0;
 848         int nsec3s_seen = 0;
 849         struct ub_packed_rrset_key* s;
 850         size_t i;
 851
 852         for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
 853                 chase_reply->ns_numrrsets; i++) {
 854                 s = chase_reply->rrsets[i];
 855                 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
 856                         if(val_nsec_proves_name_error(s, qchase->qname))
 857                                 has_valid_nsec = 1;
 858                         if(val_nsec_proves_no_wc(s, qchase->qname,
 859                                 qchase->qname_len))
 860                                 has_valid_wnsec = 1;
 861                         if(val_nsec_proves_insecuredelegation(s, qchase)) {
 862                                 verbose(VERB_ALGO, "delegation is insecure");
 863                                 chase_reply->security = sec_status_insecure;
 864                                 return;
 865                         }
 866                 } else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3)
 867                         nsec3s_seen = 1;
 868         }
 869
 870         if((!has_valid_nsec || !has_valid_wnsec) && nsec3s_seen) {
 871                 /* use NSEC3 proof, both answer and auth rrsets, in case
 872                  * NSEC3s end up in the answer (due to qtype=NSEC3 or so) */
 873                 chase_reply->security = nsec3_prove_nameerror(env, ve,
 874                         chase_reply->rrsets, chase_reply->an_numrrsets+
 875                         chase_reply->ns_numrrsets, qchase, kkey);
 876                 if(chase_reply->security != sec_status_secure) {
 877                         verbose(VERB_QUERY, "NameError response failed nsec, "
 878                                 "nsec3 proof was %s", sec_status_to_string(
 879                                 chase_reply->security));
 880                         return;
 881                 }
 882                 has_valid_nsec = 1;
 883                 has_valid_wnsec = 1;
 884         }
 885
 886         /* If the message fails to prove either condition, it is bogus. */
 887         if(!has_valid_nsec) {
 888                 verbose(VERB_QUERY, "NameError response has failed to prove: "
 889                           "qname does not exist");
 890                 chase_reply->security = sec_status_bogus;
 891                 /* Be lenient with RCODE in NSEC NameError responses */
 892                 validate_nodata_response(env, ve, qchase, chase_reply, kkey);
 893                 if (chase_reply->security == sec_status_secure)
 894                         *rcode = LDNS_RCODE_NOERROR;
 895                 return;
 896         }
 897
 898         if(!has_valid_wnsec) {
 899                 verbose(VERB_QUERY, "NameError response has failed to prove: "
 900                           "covering wildcard does not exist");
 901                 chase_reply->security = sec_status_bogus;
 902                 /* Be lenient with RCODE in NSEC NameError responses */
 903                 validate_nodata_response(env, ve, qchase, chase_reply, kkey);
 904                 if (chase_reply->security == sec_status_secure)
 905                         *rcode = LDNS_RCODE_NOERROR;
 906                 return;
 907         }
 908
 909         /* Otherwise, we consider the message secure. */
 910         verbose(VERB_ALGO, "successfully validated NAME ERROR response.");
 911         chase_reply->security = sec_status_secure;
 912 }
 913
 914 /**
 915  * Given a referral response, validate rrsets and take least trusted rrset
 916  * as the current validation status.
 917  *
 918  * Note that by the time this method is called, the process of finding the
 919  * trusted DNSKEY rrset that signs this response must already have been
 920  * completed.
 921  *
 922  * @param chase_reply: answer to validate.
 923  */
 924 static void
 925 validate_referral_response(struct reply_info* chase_reply)
 926 {
 927         size_t i;
 928         enum sec_status s;
 929         /* message security equals lowest rrset security */
 930         chase_reply->security = sec_status_secure;
 931         for(i=0; i<chase_reply->rrset_count; i++) {
 932                 s = ((struct packed_rrset_data*)chase_reply->rrsets[i]
 933                         ->entry.data)->security;
 934                 if(s < chase_reply->security)
 935                         chase_reply->security = s;
 936         }
 937         verbose(VERB_ALGO, "validated part of referral response as %s",
 938                 sec_status_to_string(chase_reply->security));
 939 }
 940
 941 /**
 942  * Given an "ANY" response -- a response that contains an answer to a
 943  * qtype==ANY question, with answers. This does no checking that all
 944  * types are present.
 945  *
 946  * NOTE: it may be possible to get parent-side delegation point records
 947  * here, which won't all be signed. Right now, this routine relies on the
 948  * upstream iterative resolver to not return these responses -- instead
 949  * treating them as referrals.
 950  *
 951  * NOTE: RFC 4035 is silent on this issue, so this may change upon
 952  * clarification. Clarification draft -05 says to not check all types are
 953  * present.
 954  *
 955  * Note that by the time this method is called, the process of finding the
 956  * trusted DNSKEY rrset that signs this response must already have been
 957  * completed.
 958  *
 959  * @param env: module env for verify.
 960  * @param ve: validator env for verify.
 961  * @param qchase: query that was made.
 962  * @param chase_reply: answer to that query to validate.
 963  * @param kkey: the key entry, which is trusted, and which matches
 964  *      the signer of the answer. The key entry isgood().
 965  */
 966 static void
 967 validate_any_response(struct module_env* env, struct val_env* ve,
 968         struct query_info* qchase, struct reply_info* chase_reply,
 969         struct key_entry_key* kkey)
 970 {
 971         /* all answer and auth rrsets already verified */
 972         /* but check if a wildcard response is given, then check NSEC/NSEC3
 973          * for qname denial to see if wildcard is applicable */
 974         uint8_t* wc = NULL;
 975         int wc_NSEC_ok = 0;
 976         int nsec3s_seen = 0;
 977         size_t i;
 978         struct ub_packed_rrset_key* s;
 979
 980         if(qchase->qtype != LDNS_RR_TYPE_ANY) {
 981                 log_err("internal error: ANY validation called for non-ANY");
 982                 chase_reply->security = sec_status_bogus;
 983                 return;
 984         }
 985
 986         /* validate the ANSWER section - this will be the answer itself */
 987         for(i=0; i<chase_reply->an_numrrsets; i++) {
 988                 s = chase_reply->rrsets[i];
 989
 990                 /* Check to see if the rrset is the result of a wildcard
 991                  * expansion. If so, an additional check will need to be
 992                  * made in the authority section. */
 993                 if(!val_rrset_wildcard(s, &wc)) {
 994                         log_nametypeclass(VERB_QUERY, "Positive ANY response"
 995                                 " has inconsistent wildcard sigs:",
 996                                 s->rk.dname, ntohs(s->rk.type),
 997                                 ntohs(s->rk.rrset_class));
 998                         chase_reply->security = sec_status_bogus;
 999                         return;
1000                 }
1001         }
1002
1003         /* if it was a wildcard, check for NSEC/NSEC3s in both answer
1004          * and authority sections (NSEC may be moved to the ANSWER section) */
1005         if(wc != NULL)
1006           for(i=0; i<chase_reply->an_numrrsets+chase_reply->ns_numrrsets;
1007                 i++) {
1008                 s = chase_reply->rrsets[i];
1009
1010                 /* If this is a positive wildcard response, and we have a
1011                  * (just verified) NSEC record, try to use it to 1) prove
1012                  * that qname doesn't exist and 2) that the correct wildcard
1013                  * was used. */
1014                 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
1015                         if(val_nsec_proves_positive_wildcard(s, qchase, wc)) {
1016                                 wc_NSEC_ok = 1;
1017                         }
1018                         /* if not, continue looking for proof */
1019                 }
1020
1021                 /* Otherwise, if this is a positive wildcard response and
1022                  * we have NSEC3 records */
1023                 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
1024                         nsec3s_seen = 1;
1025                 }
1026         }
1027
1028         /* If this was a positive wildcard response that we haven't already
1029          * proven, and we have NSEC3 records, try to prove it using the NSEC3
1030          * records. */
1031         if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) {
1032                 /* look both in answer and auth section for NSEC3s */
1033                 enum sec_status sec = nsec3_prove_wildcard(env, ve,
1034                         chase_reply->rrsets,
1035                         chase_reply->an_numrrsets+chase_reply->ns_numrrsets,
1036                         qchase, kkey, wc);
1037                 if(sec == sec_status_insecure) {
1038                         verbose(VERB_ALGO, "Positive ANY wildcard response is "
1039                                 "insecure");
1040                         chase_reply->security = sec_status_insecure;
1041                         return;
1042                 } else if(sec == sec_status_secure)
1043                         wc_NSEC_ok = 1;
1044         }
1045
1046         /* If after all this, we still haven't proven the positive wildcard
1047          * response, fail. */
1048         if(wc != NULL && !wc_NSEC_ok) {
1049                 verbose(VERB_QUERY, "positive ANY response was wildcard "
1050                         "expansion and did not prove original data "
1051                         "did not exist");
1052                 chase_reply->security = sec_status_bogus;
1053                 return;
1054         }
1055
1056         verbose(VERB_ALGO, "Successfully validated positive ANY response");
1057         chase_reply->security = sec_status_secure;
1058 }
1059
1060 /**
1061  * Validate CNAME response, or DNAME+CNAME.
1062  * This is just like a positive proof, except that this is about a
1063  * DNAME+CNAME. Possible wildcard proof.
1064  * Difference with positive proof is that this routine refuses
1065  * wildcarded DNAMEs.
1066  *
1067  * The answer and authority rrsets must already be verified as secure.
1068  *
1069  * @param env: module env for verify.
1070  * @param ve: validator env for verify.
1071  * @param qchase: query that was made.
1072  * @param chase_reply: answer to that query to validate.
1073  * @param kkey: the key entry, which is trusted, and which matches
1074  *      the signer of the answer. The key entry isgood().
1075  */
1076 static void
1077 validate_cname_response(struct module_env* env, struct val_env* ve,
1078         struct query_info* qchase, struct reply_info* chase_reply,
1079         struct key_entry_key* kkey)
1080 {
1081         uint8_t* wc = NULL;
1082         int wc_NSEC_ok = 0;
1083         int nsec3s_seen = 0;
1084         size_t i;
1085         struct ub_packed_rrset_key* s;
1086
1087         /* validate the ANSWER section - this will be the CNAME (+DNAME) */
1088         for(i=0; i<chase_reply->an_numrrsets; i++) {
1089                 s = chase_reply->rrsets[i];
1090
1091                 /* Check to see if the rrset is the result of a wildcard
1092                  * expansion. If so, an additional check will need to be
1093                  * made in the authority section. */
1094                 if(!val_rrset_wildcard(s, &wc)) {
1095                         log_nametypeclass(VERB_QUERY, "Cname response has "
1096                                 "inconsistent wildcard sigs:", s->rk.dname,
1097                                 ntohs(s->rk.type), ntohs(s->rk.rrset_class));
1098                         chase_reply->security = sec_status_bogus;
1099                         return;
1100                 }
1101
1102                 /* Refuse wildcarded DNAMEs rfc 4597.
1103                  * Do not follow a wildcarded DNAME because
1104                  * its synthesized CNAME expansion is underdefined */
1105                 if(qchase->qtype != LDNS_RR_TYPE_DNAME &&
1106                         ntohs(s->rk.type) == LDNS_RR_TYPE_DNAME && wc) {
1107                         log_nametypeclass(VERB_QUERY, "cannot validate a "
1108                                 "wildcarded DNAME:", s->rk.dname,
1109                                 ntohs(s->rk.type), ntohs(s->rk.rrset_class));
1110                         chase_reply->security = sec_status_bogus;
1111                         return;
1112                 }
1113
1114                 /* If we have found a CNAME, stop looking for one.
1115                  * The iterator has placed the CNAME chain in correct
1116                  * order. */
1117                 if (ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME) {
1118                         break;
1119                 }
1120         }
1121
1122         /* AUTHORITY section */
1123         for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
1124                 chase_reply->ns_numrrsets; i++) {
1125                 s = chase_reply->rrsets[i];
1126
1127                 /* If this is a positive wildcard response, and we have a
1128                  * (just verified) NSEC record, try to use it to 1) prove
1129                  * that qname doesn't exist and 2) that the correct wildcard
1130                  * was used. */
1131                 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
1132                         if(val_nsec_proves_positive_wildcard(s, qchase, wc)) {
1133                                 wc_NSEC_ok = 1;
1134                         }
1135                         /* if not, continue looking for proof */
1136                 }
1137
1138                 /* Otherwise, if this is a positive wildcard response and
1139                  * we have NSEC3 records */
1140                 if(wc != NULL && ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
1141                         nsec3s_seen = 1;
1142                 }
1143         }
1144
1145         /* If this was a positive wildcard response that we haven't already
1146          * proven, and we have NSEC3 records, try to prove it using the NSEC3
1147          * records. */
1148         if(wc != NULL && !wc_NSEC_ok && nsec3s_seen) {
1149                 enum sec_status sec = nsec3_prove_wildcard(env, ve,
1150                         chase_reply->rrsets+chase_reply->an_numrrsets,
1151                         chase_reply->ns_numrrsets, qchase, kkey, wc);
1152                 if(sec == sec_status_insecure) {
1153                         verbose(VERB_ALGO, "wildcard CNAME response is "
1154                                 "insecure");
1155                         chase_reply->security = sec_status_insecure;
1156                         return;
1157                 } else if(sec == sec_status_secure)
1158                         wc_NSEC_ok = 1;
1159         }
1160
1161         /* If after all this, we still haven't proven the positive wildcard
1162          * response, fail. */
1163         if(wc != NULL && !wc_NSEC_ok) {
1164                 verbose(VERB_QUERY, "CNAME response was wildcard "
1165                         "expansion and did not prove original data "
1166                         "did not exist");
1167                 chase_reply->security = sec_status_bogus;
1168                 return;
1169         }
1170
1171         verbose(VERB_ALGO, "Successfully validated CNAME response");
1172         chase_reply->security = sec_status_secure;
1173 }
1174
1175 /**
1176  * Validate CNAME NOANSWER response, no more data after a CNAME chain.
1177  * This can be a NODATA or a NAME ERROR case, but not both at the same time.
1178  * We don't know because the rcode has been set to NOERROR by the CNAME.
1179  *
1180  * The answer and authority rrsets must already be verified as secure.
1181  *
1182  * @param env: module env for verify.
1183  * @param ve: validator env for verify.
1184  * @param qchase: query that was made.
1185  * @param chase_reply: answer to that query to validate.
1186  * @param kkey: the key entry, which is trusted, and which matches
1187  *      the signer of the answer. The key entry isgood().
1188  */
1189 static void
1190 validate_cname_noanswer_response(struct module_env* env, struct val_env* ve,
1191         struct query_info* qchase, struct reply_info* chase_reply,
1192         struct key_entry_key* kkey)
1193 {
1194         int nodata_valid_nsec = 0; /* If true, then NODATA has been proven.*/
1195         uint8_t* ce = NULL; /* for wildcard nodata responses. This is the
1196                                 proven closest encloser. */
1197         uint8_t* wc = NULL; /* for wildcard nodata responses. wildcard nsec */
1198         int nxdomain_valid_nsec = 0; /* if true, namerror has been proven */
1199         int nxdomain_valid_wnsec = 0;
1200         int nsec3s_seen = 0; /* nsec3s seen */
1201         struct ub_packed_rrset_key* s;
1202         size_t i;
1203
1204         /* the AUTHORITY section */
1205         for(i=chase_reply->an_numrrsets; i<chase_reply->an_numrrsets+
1206                 chase_reply->ns_numrrsets; i++) {
1207                 s = chase_reply->rrsets[i];
1208
1209                 /* If we encounter an NSEC record, try to use it to prove
1210                  * NODATA. This needs to handle the ENT NODATA case.
1211                  * Also try to prove NAMEERROR, and absence of a wildcard */
1212                 if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC) {
1213                         if(nsec_proves_nodata(s, qchase, &wc)) {
1214                                 nodata_valid_nsec = 1;
1215                                 /* set wc encloser if wildcard applicable */
1216                         }
1217                         if(val_nsec_proves_name_error(s, qchase->qname)) {
1218                                 ce = nsec_closest_encloser(qchase->qname, s);
1219                                 nxdomain_valid_nsec = 1;
1220                         }
1221                         if(val_nsec_proves_no_wc(s, qchase->qname,
1222                                 qchase->qname_len))
1223                                 nxdomain_valid_wnsec = 1;
1224                         if(val_nsec_proves_insecuredelegation(s, qchase)) {
1225                                 verbose(VERB_ALGO, "delegation is insecure");
1226                                 chase_reply->security = sec_status_insecure;
1227                                 return;
1228                         }
1229                 } else if(ntohs(s->rk.type) == LDNS_RR_TYPE_NSEC3) {
1230                         nsec3s_seen = 1;
1231                 }
1232         }
1233
1234         /* check to see if we have a wildcard NODATA proof. */
1235
1236         /* The wildcard NODATA is 1 NSEC proving that qname does not exists
1237          * (and also proving what the closest encloser is), and 1 NSEC
1238          * showing the matching wildcard, which must be *.closest_encloser. */
1239         if(wc && !ce)
1240                 nodata_valid_nsec = 0;
1241         else if(wc && ce) {
1242                 if(query_dname_compare(wc, ce) != 0) {
1243                         nodata_valid_nsec = 0;
1244                 }
1245         }
1246         if(nxdomain_valid_nsec && !nxdomain_valid_wnsec) {
1247                 /* name error is missing wildcard denial proof */
1248                 nxdomain_valid_nsec = 0;
1249         }
1250
1251         if(nodata_valid_nsec && nxdomain_valid_nsec) {
1252                 verbose(VERB_QUERY, "CNAMEchain to noanswer proves that name "
1253                         "exists and not exists, bogus");
1254                 chase_reply->security = sec_status_bogus;
1255                 return;
1256         }
1257         if(!nodata_valid_nsec && !nxdomain_valid_nsec && nsec3s_seen) {
1258                 int nodata;
1259                 enum sec_status sec = nsec3_prove_nxornodata(env, ve,
1260                         chase_reply->rrsets+chase_reply->an_numrrsets,
1261                         chase_reply->ns_numrrsets, qchase, kkey, &nodata);
1262                 if(sec == sec_status_insecure) {
1263                         verbose(VERB_ALGO, "CNAMEchain to noanswer response "
1264                                 "is insecure");
1265                         chase_reply->security = sec_status_insecure;
1266                         return;
1267                 } else if(sec == sec_status_secure) {
1268                         if(nodata)
1269                                 nodata_valid_nsec = 1;
1270                         else    nxdomain_valid_nsec = 1;
1271                 }
1272         }
1273
1274         if(!nodata_valid_nsec && !nxdomain_valid_nsec) {
1275                 verbose(VERB_QUERY, "CNAMEchain to noanswer response failed "
1276                         "to prove status with NSEC/NSEC3");
1277                 if(verbosity >= VERB_ALGO)
1278                         log_dns_msg("Failed CNAMEnoanswer", qchase, chase_reply);
1279                 chase_reply->security = sec_status_bogus;
1280                 return;
1281         }
1282
1283         if(nodata_valid_nsec)
1284                 verbose(VERB_ALGO, "successfully validated CNAME chain to a "
1285                         "NODATA response.");
1286         else    verbose(VERB_ALGO, "successfully validated CNAME chain to a "
1287                         "NAMEERROR response.");
1288         chase_reply->security = sec_status_secure;
1289 }
1290
1291 /**
1292  * Process init state for validator.
1293  * Process the INIT state. First tier responses start in the INIT state.
1294  * This is where they are vetted for validation suitability, and the initial
1295  * key search is done.
1296  *
1297  * Currently, events the come through this routine will be either promoted
1298  * to FINISHED/CNAME_RESP (no validation needed), FINDKEY (next step to
1299  * validation), or will be (temporarily) retired and a new priming request
1300  * event will be generated.
1301  *
1302  * @param qstate: query state.
1303  * @param vq: validator query state.
1304  * @param ve: validator shared global environment.
1305  * @param id: module id.
1306  * @return true if the event should be processed further on return, false if
1307  *         not.
1308  */
1309 static int
1310 processInit(struct module_qstate* qstate, struct val_qstate* vq,
1311         struct val_env* ve, int id)
1312 {
1313         uint8_t* lookup_name;
1314         size_t lookup_len;
1315         struct trust_anchor* anchor;
1316         enum val_classification subtype = val_classify_response(
1317                 qstate->query_flags, &qstate->qinfo, &vq->qchase,
1318                 vq->orig_msg->rep, vq->rrset_skip);
1319         if(vq->restart_count > VAL_MAX_RESTART_COUNT) {
1320                 verbose(VERB_ALGO, "restart count exceeded");
1321                 return val_error(qstate, id);
1322         }
1323         verbose(VERB_ALGO, "validator classification %s",
1324                 val_classification_to_string(subtype));
1325         if(subtype == VAL_CLASS_REFERRAL &&
1326                 vq->rrset_skip < vq->orig_msg->rep->rrset_count) {
1327                 /* referral uses the rrset name as qchase, to find keys for
1328                  * that rrset */
1329                 vq->qchase.qname = vq->orig_msg->rep->
1330                         rrsets[vq->rrset_skip]->rk.dname;
1331                 vq->qchase.qname_len = vq->orig_msg->rep->
1332                         rrsets[vq->rrset_skip]->rk.dname_len;
1333                 vq->qchase.qtype = ntohs(vq->orig_msg->rep->
1334                         rrsets[vq->rrset_skip]->rk.type);
1335                 vq->qchase.qclass = ntohs(vq->orig_msg->rep->
1336                         rrsets[vq->rrset_skip]->rk.rrset_class);
1337         }
1338         lookup_name = vq->qchase.qname;
1339         lookup_len = vq->qchase.qname_len;
1340         /* for type DS look at the parent side for keys/trustanchor */
1341         /* also for NSEC not at apex */
1342         if(vq->qchase.qtype == LDNS_RR_TYPE_DS ||
1343                 (vq->qchase.qtype == LDNS_RR_TYPE_NSEC &&
1344                  vq->orig_msg->rep->rrset_count > vq->rrset_skip &&
1345                  ntohs(vq->orig_msg->rep->rrsets[vq->rrset_skip]->rk.type) ==
1346                  LDNS_RR_TYPE_NSEC &&
1347                  !(vq->orig_msg->rep->rrsets[vq->rrset_skip]->
1348                  rk.flags&PACKED_RRSET_NSEC_AT_APEX))) {
1349                 dname_remove_label(&lookup_name, &lookup_len);
1350         }
1351
1352         val_mark_indeterminate(vq->chase_reply, qstate->env->anchors,
1353                 qstate->env->rrset_cache, qstate->env);
1354         vq->key_entry = NULL;
1355         vq->empty_DS_name = NULL;
1356         vq->ds_rrset = 0;
1357         anchor = anchors_lookup(qstate->env->anchors,
1358                 lookup_name, lookup_len, vq->qchase.qclass);
1359
1360         /* Determine the signer/lookup name */
1361         val_find_signer(subtype, &vq->qchase, vq->orig_msg->rep,
1362                 vq->rrset_skip, &vq->signer_name, &vq->signer_len);
1363         if(vq->signer_name != NULL &&
1364                 !dname_subdomain_c(lookup_name, vq->signer_name)) {
1365                 log_nametypeclass(VERB_ALGO, "this signer name is not a parent "
1366                         "of lookupname, omitted", vq->signer_name, 0, 0);
1367                 vq->signer_name = NULL;
1368         }
1369         if(vq->signer_name == NULL) {
1370                 log_nametypeclass(VERB_ALGO, "no signer, using", lookup_name,
1371                         0, 0);
1372         } else {
1373                 lookup_name = vq->signer_name;
1374                 lookup_len = vq->signer_len;
1375                 log_nametypeclass(VERB_ALGO, "signer is", lookup_name, 0, 0);
1376         }
1377
1378         /* for NXDOMAIN it could be signed by a parent of the trust anchor */
1379         if(subtype == VAL_CLASS_NAMEERROR && vq->signer_name &&
1380                 anchor && dname_strict_subdomain_c(anchor->name, lookup_name)){
1381                 lock_basic_unlock(&anchor->lock);
1382                 anchor = anchors_lookup(qstate->env->anchors,
1383                         lookup_name, lookup_len, vq->qchase.qclass);
1384                 if(!anchor) { /* unsigned parent denies anchor*/
1385                         verbose(VERB_QUERY, "unsigned parent zone denies"
1386                                 " trust anchor, indeterminate");
1387                         vq->chase_reply->security = sec_status_indeterminate;
1388                         vq->state = VAL_FINISHED_STATE;
1389                         return 1;
1390                 }
1391                 verbose(VERB_ALGO, "trust anchor NXDOMAIN by signed parent");
1392         } else if(subtype == VAL_CLASS_POSITIVE &&
1393                 qstate->qinfo.qtype == LDNS_RR_TYPE_DNSKEY &&
1394                 query_dname_compare(lookup_name, qstate->qinfo.qname) == 0) {
1395                 /* is a DNSKEY so lookup a bit higher since we want to
1396                  * get it from a parent or from trustanchor */
1397                 dname_remove_label(&lookup_name, &lookup_len);
1398         }
1399
1400         if(vq->rrset_skip > 0 || subtype == VAL_CLASS_CNAME ||
1401                 subtype == VAL_CLASS_REFERRAL) {
1402                 /* extract this part of orig_msg into chase_reply for
1403                  * the eventual VALIDATE stage */
1404                 val_fill_reply(vq->chase_reply, vq->orig_msg->rep,
1405                         vq->rrset_skip, lookup_name, lookup_len,
1406                         vq->signer_name);
1407                 if(verbosity >= VERB_ALGO)
1408                         log_dns_msg("chased extract", &vq->qchase,
1409                                 vq->chase_reply);
1410         }
1411
1412         vq->key_entry = key_cache_obtain(ve->kcache, lookup_name, lookup_len,
1413                 vq->qchase.qclass, qstate->region, *qstate->env->now);
1414
1415         /* there is no key(from DLV) and no trust anchor */
1416         if(vq->key_entry == NULL && anchor == NULL) {
1417                 /*response isn't under a trust anchor, so we cannot validate.*/
1418                 vq->chase_reply->security = sec_status_indeterminate;
1419                 /* go to finished state to cache this result */
1420                 vq->state = VAL_FINISHED_STATE;
1421                 return 1;
1422         }
1423         /* if not key, or if keyentry is *above* the trustanchor, i.e.
1424          * the keyentry is based on another (higher) trustanchor */
1425         else if(vq->key_entry == NULL || (anchor &&
1426                 dname_strict_subdomain_c(anchor->name, vq->key_entry->name))) {
1427                 /* trust anchor is an 'unsigned' trust anchor */
1428                 if(anchor && anchor->numDS == 0 && anchor->numDNSKEY == 0) {
1429                         vq->chase_reply->security = sec_status_insecure;
1430                         val_mark_insecure(vq->chase_reply, anchor->name,
1431                                 qstate->env->rrset_cache, qstate->env);
1432                         lock_basic_unlock(&anchor->lock);
1433                         vq->dlv_checked=1; /* skip DLV check */
1434                         /* go to finished state to cache this result */
1435                         vq->state = VAL_FINISHED_STATE;
1436                         return 1;
1437                 }
1438                 /* fire off a trust anchor priming query. */
1439                 verbose(VERB_DETAIL, "prime trust anchor");
1440                 if(!prime_trust_anchor(qstate, vq, id, anchor)) {
1441                         lock_basic_unlock(&anchor->lock);
1442                         return val_error(qstate, id);
1443                 }
1444                 lock_basic_unlock(&anchor->lock);
1445                 /* and otherwise, don't continue processing this event.
1446                  * (it will be reactivated when the priming query returns). */
1447                 vq->state = VAL_FINDKEY_STATE;
1448                 return 0;
1449         }
1450         if(anchor) {
1451                 lock_basic_unlock(&anchor->lock);
1452         }
1453
1454         if(key_entry_isnull(vq->key_entry)) {
1455                 /* response is under a null key, so we cannot validate
1456                  * However, we do set the status to INSECURE, since it is
1457                  * essentially proven insecure. */
1458                 vq->chase_reply->security = sec_status_insecure;
1459                 val_mark_insecure(vq->chase_reply, vq->key_entry->name,
1460                         qstate->env->rrset_cache, qstate->env);
1461                 /* go to finished state to cache this result */
1462                 vq->state = VAL_FINISHED_STATE;
1463                 return 1;
1464         } else if(key_entry_isbad(vq->key_entry)) {
1465                 /* key is bad, chain is bad, reply is bogus */
1466                 errinf_dname(qstate, "key for validation", vq->key_entry->name);
1467                 errinf(qstate, "is marked as invalid");
1468                 if(key_entry_get_reason(vq->key_entry)) {
1469                         errinf(qstate, "because of a previous");
1470                         errinf(qstate, key_entry_get_reason(vq->key_entry));
1471                 }
1472                 /* no retries, stop bothering the authority until timeout */
1473                 vq->restart_count = VAL_MAX_RESTART_COUNT;
1474                 vq->chase_reply->security = sec_status_bogus;
1475                 vq->state = VAL_FINISHED_STATE;
1476                 return 1;
1477         }
1478
1479         /* otherwise, we have our "closest" cached key -- continue
1480          * processing in the next state. */
1481         vq->state = VAL_FINDKEY_STATE;
1482         return 1;
1483 }
1484
1485 /**
1486  * Process the FINDKEY state. Generally this just calculates the next name
1487  * to query and either issues a DS or a DNSKEY query. It will check to see
1488  * if the correct key has already been reached, in which case it will
1489  * advance the event to the next state.
1490  *
1491  * @param qstate: query state.
1492  * @param vq: validator query state.
1493  * @param id: module id.
1494  * @return true if the event should be processed further on return, false if
1495  *         not.
1496  */
1497 static int
1498 processFindKey(struct module_qstate* qstate, struct val_qstate* vq, int id)
1499 {
1500         uint8_t* target_key_name, *current_key_name;
1501         size_t target_key_len;
1502         int strip_lab;
1503
1504         log_query_info(VERB_ALGO, "validator: FindKey", &vq->qchase);
1505         /* We know that state.key_entry is not 0 or bad key -- if it were,
1506          * then previous processing should have directed this event to
1507          * a different state.
1508          * It could be an isnull key, which signals that a DLV was just
1509          * done and the DNSKEY after the DLV failed with dnssec-retry state
1510          * and the DNSKEY has to be performed again. */
1511         log_assert(vq->key_entry && !key_entry_isbad(vq->key_entry));
1512         if(key_entry_isnull(vq->key_entry)) {
1513                 if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
1514                         vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
1515                         vq->qchase.qclass, BIT_CD)) {
1516                         log_err("mem error generating DNSKEY request");
1517                         return val_error(qstate, id);
1518                 }
1519                 return 0;
1520         }
1521
1522         target_key_name = vq->signer_name;
1523         target_key_len = vq->signer_len;
1524         if(!target_key_name) {
1525                 target_key_name = vq->qchase.qname;
1526                 target_key_len = vq->qchase.qname_len;
1527         }
1528
1529         current_key_name = vq->key_entry->name;
1530
1531         /* If our current key entry matches our target, then we are done. */
1532         if(query_dname_compare(target_key_name, current_key_name) == 0) {
1533                 vq->state = VAL_VALIDATE_STATE;
1534                 return 1;
1535         }
1536
1537         if(vq->empty_DS_name) {
1538                 /* if the last empty nonterminal/emptyDS name we detected is
1539                  * below the current key, use that name to make progress
1540                  * along the chain of trust */
1541                 if(query_dname_compare(target_key_name,
1542                         vq->empty_DS_name) == 0) {
1543                         /* do not query for empty_DS_name again */
1544                         verbose(VERB_ALGO, "Cannot retrieve DS for signature");
1545                         errinf(qstate, "no signatures");
1546                         errinf_origin(qstate, qstate->reply_origin);
1547                         vq->chase_reply->security = sec_status_bogus;
1548                         vq->state = VAL_FINISHED_STATE;
1549                         return 1;
1550                 }
1551                 current_key_name = vq->empty_DS_name;
1552         }
1553
1554         log_nametypeclass(VERB_ALGO, "current keyname", current_key_name,
1555                 LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN);
1556         log_nametypeclass(VERB_ALGO, "target keyname", target_key_name,
1557                 LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN);
1558         /* assert we are walking down the DNS tree */
1559         if(!dname_subdomain_c(target_key_name, current_key_name)) {
1560                 verbose(VERB_ALGO, "bad signer name");
1561                 vq->chase_reply->security = sec_status_bogus;
1562                 vq->state = VAL_FINISHED_STATE;
1563                 return 1;
1564         }
1565         /* so this value is >= -1 */
1566         strip_lab = dname_count_labels(target_key_name) -
1567                 dname_count_labels(current_key_name) - 1;
1568         log_assert(strip_lab >= -1);
1569         verbose(VERB_ALGO, "striplab %d", strip_lab);
1570         if(strip_lab > 0) {
1571                 dname_remove_labels(&target_key_name, &target_key_len,
1572                         strip_lab);
1573         }
1574         log_nametypeclass(VERB_ALGO, "next keyname", target_key_name,
1575                 LDNS_RR_TYPE_DNSKEY, LDNS_RR_CLASS_IN);
1576
1577         /* The next step is either to query for the next DS, or to query
1578          * for the next DNSKEY. */
1579         if(vq->ds_rrset)
1580                 log_nametypeclass(VERB_ALGO, "DS RRset", vq->ds_rrset->rk.dname, LDNS_RR_TYPE_DS, LDNS_RR_CLASS_IN);
1581         else verbose(VERB_ALGO, "No DS RRset");
1582
1583         if(vq->ds_rrset && query_dname_compare(vq->ds_rrset->rk.dname,
1584                 vq->key_entry->name) != 0) {
1585                 if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
1586                         vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
1587                         vq->qchase.qclass, BIT_CD)) {
1588                         log_err("mem error generating DNSKEY request");
1589                         return val_error(qstate, id);
1590                 }
1591                 return 0;
1592         }
1593
1594         if(!vq->ds_rrset || query_dname_compare(vq->ds_rrset->rk.dname,
1595                 target_key_name) != 0) {
1596                 /* check if there is a cache entry : pick up an NSEC if
1597                  * there is no DS, check if that NSEC has DS-bit unset, and
1598                  * thus can disprove the secure delagation we seek.
1599                  * We can then use that NSEC even in the absence of a SOA
1600                  * record that would be required by the iterator to supply
1601                  * a completely protocol-correct response.
1602                  * Uses negative cache for NSEC3 lookup of DS responses. */
1603                 /* only if cache not blacklisted, of course */
1604                 struct dns_msg* msg;
1605                 if(!qstate->blacklist && !vq->chain_blacklist &&
1606                         (msg=val_find_DS(qstate->env, target_key_name,
1607                         target_key_len, vq->qchase.qclass, qstate->region,
1608                         vq->key_entry->name)) ) {
1609                         verbose(VERB_ALGO, "Process cached DS response");
1610                         process_ds_response(qstate, vq, id, LDNS_RCODE_NOERROR,
1611                                 msg, &msg->qinfo, NULL);
1612                         return 1; /* continue processing ds-response results */
1613                 }
1614                 if(!generate_request(qstate, id, target_key_name,
1615                         target_key_len, LDNS_RR_TYPE_DS, vq->qchase.qclass,
1616                         BIT_CD)) {
1617                         log_err("mem error generating DS request");
1618                         return val_error(qstate, id);
1619                 }
1620                 return 0;
1621         }
1622
1623         /* Otherwise, it is time to query for the DNSKEY */
1624         if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
1625                 vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
1626                 vq->qchase.qclass, BIT_CD)) {
1627                 log_err("mem error generating DNSKEY request");
1628                 return val_error(qstate, id);
1629         }
1630
1631         return 0;
1632 }
1633
1634 /**
1635  * Process the VALIDATE stage, the init and findkey stages are finished,
1636  * and the right keys are available to validate the response.
1637  * Or, there are no keys available, in order to invalidate the response.
1638  *
1639  * After validation, the status is recorded in the message and rrsets,
1640  * and finished state is started.
1641  *
1642  * @param qstate: query state.
1643  * @param vq: validator query state.
1644  * @param ve: validator shared global environment.
1645  * @param id: module id.
1646  * @return true if the event should be processed further on return, false if
1647  *         not.
1648  */
1649 static int
1650 processValidate(struct module_qstate* qstate, struct val_qstate* vq,
1651         struct val_env* ve, int id)
1652 {
1653         enum val_classification subtype;
1654         int rcode;
1655
1656         if(!vq->key_entry) {
1657                 verbose(VERB_ALGO, "validate: no key entry, failed");
1658                 return val_error(qstate, id);
1659         }
1660
1661         /* This is the default next state. */
1662         vq->state = VAL_FINISHED_STATE;
1663
1664         /* Unsigned responses must be underneath a "null" key entry.*/
1665         if(key_entry_isnull(vq->key_entry)) {
1666                 verbose(VERB_DETAIL, "Verified that %sresponse is INSECURE",
1667                         vq->signer_name?"":"unsigned ");
1668                 vq->chase_reply->security = sec_status_insecure;
1669                 val_mark_insecure(vq->chase_reply, vq->key_entry->name,
1670                         qstate->env->rrset_cache, qstate->env);
1671                 key_cache_insert(ve->kcache, vq->key_entry, qstate);
1672                 return 1;
1673         }
1674
1675         if(key_entry_isbad(vq->key_entry)) {
1676                 log_nametypeclass(VERB_DETAIL, "Could not establish a chain "
1677                         "of trust to keys for", vq->key_entry->name,
1678                         LDNS_RR_TYPE_DNSKEY, vq->key_entry->key_class);
1679                 vq->chase_reply->security = sec_status_bogus;
1680                 errinf(qstate, "while building chain of trust");
1681                 if(vq->restart_count >= VAL_MAX_RESTART_COUNT)
1682                         key_cache_insert(ve->kcache, vq->key_entry, qstate);
1683                 return 1;
1684         }
1685
1686         /* signerName being null is the indicator that this response was
1687          * unsigned */
1688         if(vq->signer_name == NULL) {
1689                 log_query_info(VERB_ALGO, "processValidate: state has no "
1690                         "signer name", &vq->qchase);
1691                 verbose(VERB_DETAIL, "Could not establish validation of "
1692                           "INSECURE status of unsigned response.");
1693                 errinf(qstate, "no signatures");
1694                 errinf_origin(qstate, qstate->reply_origin);
1695                 vq->chase_reply->security = sec_status_bogus;
1696                 return 1;
1697         }
1698         subtype = val_classify_response(qstate->query_flags, &qstate->qinfo,
1699                 &vq->qchase, vq->orig_msg->rep, vq->rrset_skip);
1700         if(subtype != VAL_CLASS_REFERRAL)
1701                 remove_spurious_authority(vq->chase_reply, vq->orig_msg->rep);
1702
1703         /* check signatures in the message;
1704          * answer and authority must be valid, additional is only checked. */
1705         if(!validate_msg_signatures(qstate, qstate->env, ve, &vq->qchase,
1706                 vq->chase_reply, vq->key_entry)) {
1707                 /* workaround bad recursor out there that truncates (even
1708                  * with EDNS4k) to 512 by removing RRSIG from auth section
1709                  * for positive replies*/
1710                 if((subtype == VAL_CLASS_POSITIVE || subtype == VAL_CLASS_ANY
1711                         || subtype == VAL_CLASS_CNAME) &&
1712                         detect_wrongly_truncated(vq->orig_msg->rep)) {
1713                         /* truncate the message some more */
1714                         vq->orig_msg->rep->ns_numrrsets = 0;
1715                         vq->orig_msg->rep->ar_numrrsets = 0;
1716                         vq->orig_msg->rep->rrset_count =
1717                                 vq->orig_msg->rep->an_numrrsets;
1718                         vq->chase_reply->ns_numrrsets = 0;
1719                         vq->chase_reply->ar_numrrsets = 0;
1720                         vq->chase_reply->rrset_count =
1721                                 vq->chase_reply->an_numrrsets;
1722                         qstate->errinf = NULL;
1723                 }
1724                 else {
1725                         verbose(VERB_DETAIL, "Validate: message contains "
1726                                 "bad rrsets");
1727                         return 1;
1728                 }
1729         }
1730
1731         switch(subtype) {
1732                 case VAL_CLASS_POSITIVE:
1733                         verbose(VERB_ALGO, "Validating a positive response");
1734                         validate_positive_response(qstate->env, ve,
1735                                 &vq->qchase, vq->chase_reply, vq->key_entry);
1736                         verbose(VERB_DETAIL, "validate(positive): %s",
1737                                 sec_status_to_string(
1738                                 vq->chase_reply->security));
1739                         break;
1740
1741                 case VAL_CLASS_NODATA:
1742                         verbose(VERB_ALGO, "Validating a nodata response");
1743                         validate_nodata_response(qstate->env, ve,
1744                                 &vq->qchase, vq->chase_reply, vq->key_entry);
1745                         verbose(VERB_DETAIL, "validate(nodata): %s",
1746                                 sec_status_to_string(
1747                                 vq->chase_reply->security));
1748                         break;
1749
1750                 case VAL_CLASS_NAMEERROR:
1751                         rcode = (int)FLAGS_GET_RCODE(vq->orig_msg->rep->flags);
1752                         verbose(VERB_ALGO, "Validating a nxdomain response");
1753                         validate_nameerror_response(qstate->env, ve,
1754                                 &vq->qchase, vq->chase_reply, vq->key_entry, &rcode);
1755                         verbose(VERB_DETAIL, "validate(nxdomain): %s",
1756                                 sec_status_to_string(
1757                                 vq->chase_reply->security));
1758                         FLAGS_SET_RCODE(vq->orig_msg->rep->flags, rcode);
1759                         FLAGS_SET_RCODE(vq->chase_reply->flags, rcode);
1760                         break;
1761
1762                 case VAL_CLASS_CNAME:
1763                         verbose(VERB_ALGO, "Validating a cname response");
1764                         validate_cname_response(qstate->env, ve,
1765                                 &vq->qchase, vq->chase_reply, vq->key_entry);
1766                         verbose(VERB_DETAIL, "validate(cname): %s",
1767                                 sec_status_to_string(
1768                                 vq->chase_reply->security));
1769                         break;
1770
1771                 case VAL_CLASS_CNAMENOANSWER:
1772                         verbose(VERB_ALGO, "Validating a cname noanswer "
1773                                 "response");
1774                         validate_cname_noanswer_response(qstate->env, ve,
1775                                 &vq->qchase, vq->chase_reply, vq->key_entry);
1776                         verbose(VERB_DETAIL, "validate(cname_noanswer): %s",
1777                                 sec_status_to_string(
1778                                 vq->chase_reply->security));
1779                         break;
1780
1781                 case VAL_CLASS_REFERRAL:
1782                         verbose(VERB_ALGO, "Validating a referral response");
1783                         validate_referral_response(vq->chase_reply);
1784                         verbose(VERB_DETAIL, "validate(referral): %s",
1785                                 sec_status_to_string(
1786                                 vq->chase_reply->security));
1787                         break;
1788
1789                 case VAL_CLASS_ANY:
1790                         verbose(VERB_ALGO, "Validating a positive ANY "
1791                                 "response");
1792                         validate_any_response(qstate->env, ve, &vq->qchase,
1793                                 vq->chase_reply, vq->key_entry);
1794                         verbose(VERB_DETAIL, "validate(positive_any): %s",
1795                                 sec_status_to_string(
1796                                 vq->chase_reply->security));
1797                         break;
1798
1799                 default:
1800                         log_err("validate: unhandled response subtype: %d",
1801                                 subtype);
1802         }
1803         if(vq->chase_reply->security == sec_status_bogus) {
1804                 if(subtype == VAL_CLASS_POSITIVE)
1805                         errinf(qstate, "wildcard");
1806                 else errinf(qstate, val_classification_to_string(subtype));
1807                 errinf(qstate, "proof failed");
1808                 errinf_origin(qstate, qstate->reply_origin);
1809         }
1810
1811         return 1;
1812 }
1813
1814 /**
1815  * Init DLV check.
1816  * Called when a query is determined by other trust anchors to be insecure
1817  * (or indeterminate).  Then we look if there is a key in the DLV.
1818  * Performs aggressive negative cache check to see if there is no key.
1819  * Otherwise, spawns a DLV query, and changes to the DLV wait state.
1820  *
1821  * @param qstate: query state.
1822  * @param vq: validator query state.
1823  * @param ve: validator shared global environment.
1824  * @param id: module id.
1825  * @return  true if there is no DLV.
1826  *      false: processing is finished for the validator operate().
1827  *      This function may exit in three ways:
1828  *         o    no DLV (agressive cache), so insecure. (true)
1829  *         o    error - stop processing (false)
1830  *         o    DLV lookup was started, stop processing (false)
1831  */
1832 static int
1833 val_dlv_init(struct module_qstate* qstate, struct val_qstate* vq,
1834         struct val_env* ve, int id)
1835 {
1836         uint8_t* nm;
1837         size_t nm_len;
1838         /* there must be a DLV configured */
1839         log_assert(qstate->env->anchors->dlv_anchor);
1840         /* this bool is true to avoid looping in the DLV checks */
1841         log_assert(vq->dlv_checked);
1842
1843         /* init the DLV lookup variables */
1844         vq->dlv_lookup_name = NULL;
1845         vq->dlv_lookup_name_len = 0;
1846         vq->dlv_insecure_at = NULL;
1847         vq->dlv_insecure_at_len = 0;
1848
1849         /* Determine the name for which we want to lookup DLV.
1850          * This name is for the current message, or
1851          * for the current RRset for CNAME, referral subtypes.
1852          * If there is a signer, use that, otherwise the domain name */
1853         if(vq->signer_name) {
1854                 nm = vq->signer_name;
1855                 nm_len = vq->signer_len;
1856         } else {
1857                 /* use qchase */
1858                 nm = vq->qchase.qname;
1859                 nm_len = vq->qchase.qname_len;
1860                 if(vq->qchase.qtype == LDNS_RR_TYPE_DS)
1861                         dname_remove_label(&nm, &nm_len);
1862         }
1863         log_nametypeclass(VERB_ALGO, "DLV init look", nm, LDNS_RR_TYPE_DS,
1864                 vq->qchase.qclass);
1865         log_assert(nm && nm_len);
1866         /* sanity check: no DLV lookups below the DLV anchor itself.
1867          * Like, an securely insecure delegation there makes no sense. */
1868         if(dname_subdomain_c(nm, qstate->env->anchors->dlv_anchor->name)) {
1869                 verbose(VERB_ALGO, "DLV lookup within DLV repository denied");
1870                 return 1;
1871         }
1872         /* concat name (minus root label) + dlv name */
1873         vq->dlv_lookup_name_len = nm_len - 1 +
1874                 qstate->env->anchors->dlv_anchor->namelen;
1875         vq->dlv_lookup_name = regional_alloc(qstate->region,
1876                 vq->dlv_lookup_name_len);
1877         if(!vq->dlv_lookup_name) {
1878                 log_err("Out of memory preparing DLV lookup");
1879                 return val_error(qstate, id);
1880         }
1881         memmove(vq->dlv_lookup_name, nm, nm_len-1);
1882         memmove(vq->dlv_lookup_name+nm_len-1,
1883                 qstate->env->anchors->dlv_anchor->name,
1884                 qstate->env->anchors->dlv_anchor->namelen);
1885         log_nametypeclass(VERB_ALGO, "DLV name", vq->dlv_lookup_name,
1886                 LDNS_RR_TYPE_DLV, vq->qchase.qclass);
1887
1888         /* determine where the insecure point was determined, the DLV must
1889          * be equal or below that to continue building the trust chain
1890          * down. May be NULL if no trust chain was built yet */
1891         nm = NULL;
1892         if(vq->key_entry && key_entry_isnull(vq->key_entry)) {
1893                 nm = vq->key_entry->name;
1894                 nm_len = vq->key_entry->namelen;
1895         }
1896         if(nm) {
1897                 vq->dlv_insecure_at_len = nm_len - 1 +
1898                         qstate->env->anchors->dlv_anchor->namelen;
1899                 vq->dlv_insecure_at = regional_alloc(qstate->region,
1900                         vq->dlv_insecure_at_len);
1901                 if(!vq->dlv_insecure_at) {
1902                         log_err("Out of memory preparing DLV lookup");
1903                         return val_error(qstate, id);
1904                 }
1905                 memmove(vq->dlv_insecure_at, nm, nm_len-1);
1906                 memmove(vq->dlv_insecure_at+nm_len-1,
1907                         qstate->env->anchors->dlv_anchor->name,
1908                         qstate->env->anchors->dlv_anchor->namelen);
1909                 log_nametypeclass(VERB_ALGO, "insecure_at",
1910                         vq->dlv_insecure_at, 0, vq->qchase.qclass);
1911         }
1912
1913         /* If we can find the name in the aggressive negative cache,
1914          * give up; insecure is the answer */
1915         while(val_neg_dlvlookup(ve->neg_cache, vq->dlv_lookup_name,
1916                 vq->dlv_lookup_name_len, vq->qchase.qclass,
1917                 qstate->env->rrset_cache, *qstate->env->now)) {
1918                 /* go up */
1919                 dname_remove_label(&vq->dlv_lookup_name,
1920                         &vq->dlv_lookup_name_len);
1921                 /* too high? */
1922                 if(!dname_subdomain_c(vq->dlv_lookup_name,
1923                         qstate->env->anchors->dlv_anchor->name)) {
1924                         verbose(VERB_ALGO, "ask above dlv repo");
1925                         return 1; /* Above the repo is insecure */
1926                 }
1927                 /* above chain of trust? */
1928                 if(vq->dlv_insecure_at && !dname_subdomain_c(
1929                         vq->dlv_lookup_name, vq->dlv_insecure_at)) {
1930                         verbose(VERB_ALGO, "ask above insecure endpoint");
1931                         return 1;
1932                 }
1933         }
1934
1935         /* perform a lookup for the DLV; with validation */
1936         vq->state = VAL_DLVLOOKUP_STATE;
1937         if(!generate_request(qstate, id, vq->dlv_lookup_name,
1938                 vq->dlv_lookup_name_len, LDNS_RR_TYPE_DLV,
1939                 vq->qchase.qclass, 0)) {
1940                 return val_error(qstate, id);
1941         }
1942
1943         /* Find the closest encloser DLV from the repository.
1944          * then that is used to build another chain of trust
1945          * This may first require a query 'too low' that has NSECs in
1946          * the answer, from which we determine the closest encloser DLV.
1947          * When determine the closest encloser, skip empty nonterminals,
1948          * since we want a nonempty node in the DLV repository. */
1949
1950         return 0;
1951 }
1952
1953 /**
1954  * The Finished state. The validation status (good or bad) has been determined.
1955  *
1956  * @param qstate: query state.
1957  * @param vq: validator query state.
1958  * @param ve: validator shared global environment.
1959  * @param id: module id.
1960  * @return true if the event should be processed further on return, false if
1961  *         not.
1962  */
1963 static int
1964 processFinished(struct module_qstate* qstate, struct val_qstate* vq,
1965         struct val_env* ve, int id)
1966 {
1967         enum val_classification subtype = val_classify_response(
1968                 qstate->query_flags, &qstate->qinfo, &vq->qchase,
1969                 vq->orig_msg->rep, vq->rrset_skip);
1970
1971         /* if the result is insecure or indeterminate and we have not
1972          * checked the DLV yet, check the DLV */
1973         if((vq->chase_reply->security == sec_status_insecure ||
1974                 vq->chase_reply->security == sec_status_indeterminate) &&
1975                 qstate->env->anchors->dlv_anchor && !vq->dlv_checked) {
1976                 vq->dlv_checked = 1;
1977                 if(!val_dlv_init(qstate, vq, ve, id))
1978                         return 0;
1979         }
1980
1981         /* store overall validation result in orig_msg */
1982         if(vq->rrset_skip == 0)
1983                 vq->orig_msg->rep->security = vq->chase_reply->security;
1984         else if(subtype != VAL_CLASS_REFERRAL ||
1985                 vq->rrset_skip < vq->orig_msg->rep->an_numrrsets +
1986                 vq->orig_msg->rep->ns_numrrsets) {
1987                 /* ignore sec status of additional section if a referral
1988                  * type message skips there and
1989                  * use the lowest security status as end result. */
1990                 if(vq->chase_reply->security < vq->orig_msg->rep->security)
1991                         vq->orig_msg->rep->security =
1992                                 vq->chase_reply->security;
1993         }
1994
1995         if(subtype == VAL_CLASS_REFERRAL) {
1996                 /* for a referral, move to next unchecked rrset and check it*/
1997                 vq->rrset_skip = val_next_unchecked(vq->orig_msg->rep,
1998                         vq->rrset_skip);
1999                 if(vq->rrset_skip < vq->orig_msg->rep->rrset_count) {
2000                         /* and restart for this rrset */
2001                         verbose(VERB_ALGO, "validator: go to next rrset");
2002                         vq->chase_reply->security = sec_status_unchecked;
2003                         vq->dlv_checked = 0; /* can do DLV for this RR */
2004                         vq->state = VAL_INIT_STATE;
2005                         return 1;
2006                 }
2007                 /* referral chase is done */
2008         }
2009         if(vq->chase_reply->security != sec_status_bogus &&
2010                 subtype == VAL_CLASS_CNAME) {
2011                 /* chase the CNAME; process next part of the message */
2012                 if(!val_chase_cname(&vq->qchase, vq->orig_msg->rep,
2013                         &vq->rrset_skip)) {
2014                         verbose(VERB_ALGO, "validator: failed to chase CNAME");
2015                         vq->orig_msg->rep->security = sec_status_bogus;
2016                 } else {
2017                         /* restart process for new qchase at rrset_skip */
2018                         log_query_info(VERB_ALGO, "validator: chased to",
2019                                 &vq->qchase);
2020                         vq->chase_reply->security = sec_status_unchecked;
2021                         vq->dlv_checked = 0; /* can do DLV for this RR */
2022                         vq->state = VAL_INIT_STATE;
2023                         return 1;
2024                 }
2025         }
2026
2027         if(vq->orig_msg->rep->security == sec_status_secure) {
2028                 /* If the message is secure, check that all rrsets are
2029                  * secure (i.e. some inserted RRset for CNAME chain with
2030                  * a different signer name). And drop additional rrsets
2031                  * that are not secure (if clean-additional option is set) */
2032                 /* this may cause the msg to be marked bogus */
2033                 val_check_nonsecure(ve, vq->orig_msg->rep);
2034                 if(vq->orig_msg->rep->security == sec_status_secure) {
2035                         log_query_info(VERB_DETAIL, "validation success",
2036                                 &qstate->qinfo);
2037                 }
2038         }
2039
2040         /* if the result is bogus - set message ttl to bogus ttl to avoid
2041          * endless bogus revalidation */
2042         if(vq->orig_msg->rep->security == sec_status_bogus) {
2043                 /* see if we can try again to fetch data */
2044                 if(vq->restart_count < VAL_MAX_RESTART_COUNT) {
2045                         int restart_count = vq->restart_count+1;
2046                         verbose(VERB_ALGO, "validation failed, "
2047                                 "blacklist and retry to fetch data");
2048                         val_blacklist(&qstate->blacklist, qstate->region,
2049                                 qstate->reply_origin, 0);
2050                         qstate->reply_origin = NULL;
2051                         qstate->errinf = NULL;
2052                         memset(vq, 0, sizeof(*vq));
2053                         vq->restart_count = restart_count;
2054                         vq->state = VAL_INIT_STATE;
2055                         verbose(VERB_ALGO, "pass back to next module");
2056                         qstate->ext_state[id] = module_restart_next;
2057                         return 0;
2058                 }
2059
2060                 vq->orig_msg->rep->ttl = ve->bogus_ttl;
2061                 vq->orig_msg->rep->prefetch_ttl =
2062                         PREFETCH_TTL_CALC(vq->orig_msg->rep->ttl);
2063                 if(qstate->env->cfg->val_log_level >= 1 &&
2064                         !qstate->env->cfg->val_log_squelch) {
2065                         if(qstate->env->cfg->val_log_level < 2)
2066                                 log_query_info(0, "validation failure",
2067                                         &qstate->qinfo);
2068                         else {
2069                                 char* err = errinf_to_str(qstate);
2070                                 if(err) log_info("%s", err);
2071                                 free(err);
2072                         }
2073                 }
2074                 /* If we are in permissive mode, bogus gets indeterminate */
2075                 if(ve->permissive_mode)
2076                         vq->orig_msg->rep->security = sec_status_indeterminate;
2077         }
2078
2079         /* store results in cache */
2080         if(qstate->query_flags&BIT_RD) {
2081                 /* if secure, this will override cache anyway, no need
2082                  * to check if from parentNS */
2083                 if(!dns_cache_store(qstate->env, &vq->orig_msg->qinfo,
2084                         vq->orig_msg->rep, 0, qstate->prefetch_leeway, 0, NULL,
2085                         qstate->query_flags)) {
2086                         log_err("out of memory caching validator results");
2087                 }
2088         } else {
2089                 /* for a referral, store the verified RRsets */
2090                 /* and this does not get prefetched, so no leeway */
2091                 if(!dns_cache_store(qstate->env, &vq->orig_msg->qinfo,
2092                         vq->orig_msg->rep, 1, 0, 0, NULL,
2093                         qstate->query_flags)) {
2094                         log_err("out of memory caching validator results");
2095                 }
2096         }
2097         qstate->return_rcode = LDNS_RCODE_NOERROR;
2098         qstate->return_msg = vq->orig_msg;
2099         qstate->ext_state[id] = module_finished;
2100         return 0;
2101 }
2102
2103 /**
2104  * The DLVLookup state. Process DLV lookups.
2105  *
2106  * @param qstate: query state.
2107  * @param vq: validator query state.
2108  * @param ve: validator shared global environment.
2109  * @param id: module id.
2110  * @return true if the event should be processed further on return, false if
2111  *         not.
2112  */
2113 static int
2114 processDLVLookup(struct module_qstate* qstate, struct val_qstate* vq,
2115         struct val_env* ve, int id)
2116 {
2117         /* see if this we are ready to continue normal resolution */
2118         /* we may need more DLV lookups */
2119         if(vq->dlv_status==dlv_error)
2120                 verbose(VERB_ALGO, "DLV woke up with status dlv_error");
2121         else if(vq->dlv_status==dlv_success)
2122                 verbose(VERB_ALGO, "DLV woke up with status dlv_success");
2123         else if(vq->dlv_status==dlv_ask_higher)
2124                 verbose(VERB_ALGO, "DLV woke up with status dlv_ask_higher");
2125         else if(vq->dlv_status==dlv_there_is_no_dlv)
2126                 verbose(VERB_ALGO, "DLV woke up with status dlv_there_is_no_dlv");
2127         else    verbose(VERB_ALGO, "DLV woke up with status unknown");
2128
2129         if(vq->dlv_status == dlv_error) {
2130                 verbose(VERB_QUERY, "failed DLV lookup");
2131                 return val_error(qstate, id);
2132         } else if(vq->dlv_status == dlv_success) {
2133                 uint8_t* nm;
2134                 size_t nmlen;
2135                 /* chain continues with DNSKEY, continue in FINDKEY */
2136                 vq->state = VAL_FINDKEY_STATE;
2137
2138                 /* strip off the DLV suffix from the name; could result in . */
2139                 log_assert(dname_subdomain_c(vq->ds_rrset->rk.dname,
2140                         qstate->env->anchors->dlv_anchor->name));
2141                 nmlen = vq->ds_rrset->rk.dname_len -
2142                         qstate->env->anchors->dlv_anchor->namelen + 1;
2143                 nm = regional_alloc_init(qstate->region,
2144                         vq->ds_rrset->rk.dname, nmlen);
2145                 if(!nm) {
2146                         log_err("Out of memory in DLVLook");
2147                         return val_error(qstate, id);
2148                 }
2149                 nm[nmlen-1] = 0;
2150
2151                 vq->ds_rrset->rk.dname = nm;
2152                 vq->ds_rrset->rk.dname_len = nmlen;
2153
2154                 /* create a nullentry for the key so the dnskey lookup
2155                  * can be retried after a validation failure for it */
2156                 vq->key_entry = key_entry_create_null(qstate->region,
2157                         nm, nmlen, vq->qchase.qclass, 0, 0);
2158                 if(!vq->key_entry) {
2159                         log_err("Out of memory in DLVLook");
2160                         return val_error(qstate, id);
2161                 }
2162
2163                 if(!generate_request(qstate, id, vq->ds_rrset->rk.dname,
2164                         vq->ds_rrset->rk.dname_len, LDNS_RR_TYPE_DNSKEY,
2165                         vq->qchase.qclass, BIT_CD)) {
2166                         log_err("mem error generating DNSKEY request");
2167                         return val_error(qstate, id);
2168                 }
2169                 return 0;
2170         } else if(vq->dlv_status == dlv_there_is_no_dlv) {
2171                 /* continue with the insecure result we got */
2172                 vq->state = VAL_FINISHED_STATE;
2173                 return 1;
2174         }
2175         log_assert(vq->dlv_status == dlv_ask_higher);
2176
2177         /* ask higher, make sure we stay in DLV repo, below dlv_at */
2178         if(!dname_subdomain_c(vq->dlv_lookup_name,
2179                 qstate->env->anchors->dlv_anchor->name)) {
2180                 /* just like, there is no DLV */
2181                 verbose(VERB_ALGO, "ask above dlv repo");
2182                 vq->state = VAL_FINISHED_STATE;
2183                 return 1;
2184         }
2185         if(vq->dlv_insecure_at && !dname_subdomain_c(vq->dlv_lookup_name,
2186                 vq->dlv_insecure_at)) {
2187                 /* already checked a chain lower than dlv_lookup_name */
2188                 verbose(VERB_ALGO, "ask above insecure endpoint");
2189                 log_nametypeclass(VERB_ALGO, "enpt", vq->dlv_insecure_at, 0, 0);
2190                 vq->state = VAL_FINISHED_STATE;
2191                 return 1;
2192         }
2193
2194         /* check negative cache before making new request */
2195         if(val_neg_dlvlookup(ve->neg_cache, vq->dlv_lookup_name,
2196                 vq->dlv_lookup_name_len, vq->qchase.qclass,
2197                 qstate->env->rrset_cache, *qstate->env->now)) {
2198                 /* does not exist, go up one (go higher). */
2199                 dname_remove_label(&vq->dlv_lookup_name,
2200                         &vq->dlv_lookup_name_len);
2201                 /* limit number of labels, limited number of recursion */
2202                 return processDLVLookup(qstate, vq, ve, id);
2203         }
2204
2205         if(!generate_request(qstate, id, vq->dlv_lookup_name,
2206                 vq->dlv_lookup_name_len, LDNS_RR_TYPE_DLV,
2207                 vq->qchase.qclass, 0)) {
2208                 return val_error(qstate, id);
2209         }
2210
2211         return 0;
2212 }
2213
2214 /**
2215  * Handle validator state.
2216  * If a method returns true, the next state is started. If false, then
2217  * processing will stop.
2218  * @param qstate: query state.
2219  * @param vq: validator query state.
2220  * @param ve: validator shared global environment.
2221  * @param id: module id.
2222  */
2223 static void
2224 val_handle(struct module_qstate* qstate, struct val_qstate* vq,
2225         struct val_env* ve, int id)
2226 {
2227         int cont = 1;
2228         while(cont) {
2229                 verbose(VERB_ALGO, "val handle processing q with state %s",
2230                         val_state_to_string(vq->state));
2231                 switch(vq->state) {
2232                         case VAL_INIT_STATE:
2233                                 cont = processInit(qstate, vq, ve, id);
2234                                 break;
2235                         case VAL_FINDKEY_STATE:
2236                                 cont = processFindKey(qstate, vq, id);
2237                                 break;
2238                         case VAL_VALIDATE_STATE:
2239                                 cont = processValidate(qstate, vq, ve, id);
2240                                 break;
2241                         case VAL_FINISHED_STATE:
2242                                 cont = processFinished(qstate, vq, ve, id);
2243                                 break;
2244                         case VAL_DLVLOOKUP_STATE:
2245                                 cont = processDLVLookup(qstate, vq, ve, id);
2246                                 break;
2247                         default:
2248                                 log_warn("validator: invalid state %d",
2249                                         vq->state);
2250                                 cont = 0;
2251                                 break;
2252                 }
2253         }
2254 }
2255
2256 void
2257 val_operate(struct module_qstate* qstate, enum module_ev event, int id,
2258         struct outbound_entry* outbound)
2259 {
2260         struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2261         struct val_qstate* vq = (struct val_qstate*)qstate->minfo[id];
2262         verbose(VERB_QUERY, "validator[module %d] operate: extstate:%s "
2263                 "event:%s", id, strextstate(qstate->ext_state[id]),
2264                 strmodulevent(event));
2265         log_query_info(VERB_QUERY, "validator operate: query",
2266                 &qstate->qinfo);
2267         if(vq && qstate->qinfo.qname != vq->qchase.qname)
2268                 log_query_info(VERB_QUERY, "validator operate: chased to",
2269                 &vq->qchase);
2270         (void)outbound;
2271         if(event == module_event_new ||
2272                 (event == module_event_pass && vq == NULL)) {
2273                 /* pass request to next module, to get it */
2274                 verbose(VERB_ALGO, "validator: pass to next module");
2275                 qstate->ext_state[id] = module_wait_module;
2276                 return;
2277         }
2278         if(event == module_event_moddone) {
2279                 /* check if validation is needed */
2280                 verbose(VERB_ALGO, "validator: nextmodule returned");
2281                 if(!needs_validation(qstate, qstate->return_rcode,
2282                         qstate->return_msg)) {
2283                         /* no need to validate this */
2284                         if(qstate->return_msg)
2285                                 qstate->return_msg->rep->security =
2286                                         sec_status_indeterminate;
2287                         qstate->ext_state[id] = module_finished;
2288                         return;
2289                 }
2290                 if(already_validated(qstate->return_msg)) {
2291                         qstate->ext_state[id] = module_finished;
2292                         return;
2293                 }
2294                 /* qclass ANY should have validation result from spawned
2295                  * queries. If we get here, it is bogus or an internal error */
2296                 if(qstate->qinfo.qclass == LDNS_RR_CLASS_ANY) {
2297                         verbose(VERB_ALGO, "cannot validate classANY: bogus");
2298                         if(qstate->return_msg)
2299                                 qstate->return_msg->rep->security =
2300                                         sec_status_bogus;
2301                         qstate->ext_state[id] = module_finished;
2302                         return;
2303                 }
2304                 /* create state to start validation */
2305                 qstate->ext_state[id] = module_error; /* override this */
2306                 if(!vq) {
2307                         vq = val_new(qstate, id);
2308                         if(!vq) {
2309                                 log_err("validator: malloc failure");
2310                                 qstate->ext_state[id] = module_error;
2311                                 return;
2312                         }
2313                 } else if(!vq->orig_msg) {
2314                         if(!val_new_getmsg(qstate, vq)) {
2315                                 log_err("validator: malloc failure");
2316                                 qstate->ext_state[id] = module_error;
2317                                 return;
2318                         }
2319                 }
2320                 val_handle(qstate, vq, ve, id);
2321                 return;
2322         }
2323         if(event == module_event_pass) {
2324                 qstate->ext_state[id] = module_error; /* override this */
2325                 /* continue processing, since val_env exists */
2326                 val_handle(qstate, vq, ve, id);
2327                 return;
2328         }
2329         log_err("validator: bad event %s", strmodulevent(event));
2330         qstate->ext_state[id] = module_error;
2331         return;
2332 }
2333
2334 /**
2335  * Evaluate the response to a priming request.
2336  *
2337  * @param dnskey_rrset: DNSKEY rrset (can be NULL if none) in prime reply.
2338  *      (this rrset is allocated in the wrong region, not the qstate).
2339  * @param ta: trust anchor.
2340  * @param qstate: qstate that needs key.
2341  * @param id: module id.
2342  * @return new key entry or NULL on allocation failure.
2343  *      The key entry will either contain a validated DNSKEY rrset, or
2344  *      represent a Null key (query failed, but validation did not), or a
2345  *      Bad key (validation failed).
2346  */
2347 static struct key_entry_key*
2348 primeResponseToKE(struct ub_packed_rrset_key* dnskey_rrset,
2349         struct trust_anchor* ta, struct module_qstate* qstate, int id)
2350 {
2351         struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2352         struct key_entry_key* kkey = NULL;
2353         enum sec_status sec = sec_status_unchecked;
2354         char* reason = NULL;
2355         int downprot = 1;
2356
2357         if(!dnskey_rrset) {
2358                 log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- "
2359                         "could not fetch DNSKEY rrset",
2360                         ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
2361                 if(qstate->env->cfg->harden_dnssec_stripped) {
2362                         errinf(qstate, "no DNSKEY rrset");
2363                         kkey = key_entry_create_bad(qstate->region, ta->name,
2364                                 ta->namelen, ta->dclass, BOGUS_KEY_TTL,
2365                                 *qstate->env->now);
2366                 } else  kkey = key_entry_create_null(qstate->region, ta->name,
2367                                 ta->namelen, ta->dclass, NULL_KEY_TTL,
2368                                 *qstate->env->now);
2369                 if(!kkey) {
2370                         log_err("out of memory: allocate fail prime key");
2371                         return NULL;
2372                 }
2373                 return kkey;
2374         }
2375         /* attempt to verify with trust anchor DS and DNSKEY */
2376         kkey = val_verify_new_DNSKEYs_with_ta(qstate->region, qstate->env, ve,
2377                 dnskey_rrset, ta->ds_rrset, ta->dnskey_rrset, downprot,
2378                 &reason);
2379         if(!kkey) {
2380                 log_err("out of memory: verifying prime TA");
2381                 return NULL;
2382         }
2383         if(key_entry_isgood(kkey))
2384                 sec = sec_status_secure;
2385         else
2386                 sec = sec_status_bogus;
2387         verbose(VERB_DETAIL, "validate keys with anchor(DS): %s",
2388                 sec_status_to_string(sec));
2389
2390         if(sec != sec_status_secure) {
2391                 log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- "
2392                         "DNSKEY rrset is not secure",
2393                         ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
2394                 /* NOTE: in this case, we should probably reject the trust
2395                  * anchor for longer, perhaps forever. */
2396                 if(qstate->env->cfg->harden_dnssec_stripped) {
2397                         errinf(qstate, reason);
2398                         kkey = key_entry_create_bad(qstate->region, ta->name,
2399                                 ta->namelen, ta->dclass, BOGUS_KEY_TTL,
2400                                 *qstate->env->now);
2401                 } else  kkey = key_entry_create_null(qstate->region, ta->name,
2402                                 ta->namelen, ta->dclass, NULL_KEY_TTL,
2403                                 *qstate->env->now);
2404                 if(!kkey) {
2405                         log_err("out of memory: allocate null prime key");
2406                         return NULL;
2407                 }
2408                 return kkey;
2409         }
2410
2411         log_nametypeclass(VERB_DETAIL, "Successfully primed trust anchor",
2412                 ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
2413         return kkey;
2414 }
2415
2416 /**
2417  * In inform supers, with the resulting message and rcode and the current
2418  * keyset in the super state, validate the DS response, returning a KeyEntry.
2419  *
2420  * @param qstate: query state that is validating and asked for a DS.
2421  * @param vq: validator query state
2422  * @param id: module id.
2423  * @param rcode: rcode result value.
2424  * @param msg: result message (if rcode is OK).
2425  * @param qinfo: from the sub query state, query info.
2426  * @param ke: the key entry to return. It returns
2427  *      is_bad if the DS response fails to validate, is_null if the
2428  *      DS response indicated an end to secure space, is_good if the DS
2429  *      validated. It returns ke=NULL if the DS response indicated that the
2430  *      request wasn't a delegation point.
2431  * @return 0 on servfail error (malloc failure).
2432  */
2433 static int
2434 ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
2435         int id, int rcode, struct dns_msg* msg, struct query_info* qinfo,
2436         struct key_entry_key** ke)
2437 {
2438         struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2439         char* reason = NULL;
2440         enum val_classification subtype;
2441         if(rcode != LDNS_RCODE_NOERROR) {
2442                 char rc[16];
2443                 rc[0]=0;
2444                 (void)sldns_wire2str_rcode_buf(rcode, rc, sizeof(rc));
2445                 /* errors here pretty much break validation */
2446                 verbose(VERB_DETAIL, "DS response was error, thus bogus");
2447                 errinf(qstate, rc);
2448                 errinf(qstate, "no DS");
2449                 goto return_bogus;
2450         }
2451
2452         subtype = val_classify_response(BIT_RD, qinfo, qinfo, msg->rep, 0);
2453         if(subtype == VAL_CLASS_POSITIVE) {
2454                 struct ub_packed_rrset_key* ds;
2455                 enum sec_status sec;
2456                 ds = reply_find_answer_rrset(qinfo, msg->rep);
2457                 /* If there was no DS rrset, then we have mis-classified
2458                  * this message. */
2459                 if(!ds) {
2460                         log_warn("internal error: POSITIVE DS response was "
2461                                 "missing DS.");
2462                         errinf(qstate, "no DS record");
2463                         goto return_bogus;
2464                 }
2465                 /* Verify only returns BOGUS or SECURE. If the rrset is
2466                  * bogus, then we are done. */
2467                 sec = val_verify_rrset_entry(qstate->env, ve, ds,
2468                         vq->key_entry, &reason);
2469                 if(sec != sec_status_secure) {
2470                         verbose(VERB_DETAIL, "DS rrset in DS response did "
2471                                 "not verify");
2472                         errinf(qstate, reason);
2473                         goto return_bogus;
2474                 }
2475
2476                 /* If the DS rrset validates, we still have to make sure
2477                  * that they are usable. */
2478                 if(!val_dsset_isusable(ds)) {
2479                         /* If they aren't usable, then we treat it like
2480                          * there was no DS. */
2481                         *ke = key_entry_create_null(qstate->region,
2482                                 qinfo->qname, qinfo->qname_len, qinfo->qclass,
2483                                 ub_packed_rrset_ttl(ds), *qstate->env->now);
2484                         return (*ke) != NULL;
2485                 }
2486
2487                 /* Otherwise, we return the positive response. */
2488                 log_query_info(VERB_DETAIL, "validated DS", qinfo);
2489                 *ke = key_entry_create_rrset(qstate->region,
2490                         qinfo->qname, qinfo->qname_len, qinfo->qclass, ds,
2491                         NULL, *qstate->env->now);
2492                 return (*ke) != NULL;
2493         } else if(subtype == VAL_CLASS_NODATA ||
2494                 subtype == VAL_CLASS_NAMEERROR) {
2495                 /* NODATA means that the qname exists, but that there was
2496                  * no DS.  This is a pretty normal case. */
2497                 time_t proof_ttl = 0;
2498                 enum sec_status sec;
2499
2500                 /* make sure there are NSECs or NSEC3s with signatures */
2501                 if(!val_has_signed_nsecs(msg->rep, &reason)) {
2502                         verbose(VERB_ALGO, "no NSECs: %s", reason);
2503                         errinf(qstate, reason);
2504                         goto return_bogus;
2505                 }
2506
2507                 /* For subtype Name Error.
2508                  * attempt ANS 2.8.1.0 compatibility where it sets rcode
2509                  * to nxdomain, but really this is an Nodata/Noerror response.
2510                  * Find and prove the empty nonterminal in that case */
2511
2512                 /* Try to prove absence of the DS with NSEC */
2513                 sec = val_nsec_prove_nodata_dsreply(
2514                         qstate->env, ve, qinfo, msg->rep, vq->key_entry,
2515                         &proof_ttl, &reason);
2516                 switch(sec) {
2517                         case sec_status_secure:
2518                                 verbose(VERB_DETAIL, "NSEC RRset for the "
2519                                         "referral proved no DS.");
2520                                 *ke = key_entry_create_null(qstate->region,
2521                                         qinfo->qname, qinfo->qname_len,
2522                                         qinfo->qclass, proof_ttl,
2523                                         *qstate->env->now);
2524                                 return (*ke) != NULL;
2525                         case sec_status_insecure:
2526                                 verbose(VERB_DETAIL, "NSEC RRset for the "
2527                                   "referral proved not a delegation point");
2528                                 *ke = NULL;
2529                                 return 1;
2530                         case sec_status_bogus:
2531                                 verbose(VERB_DETAIL, "NSEC RRset for the "
2532                                         "referral did not prove no DS.");
2533                                 errinf(qstate, reason);
2534                                 goto return_bogus;
2535                         case sec_status_unchecked:
2536                         default:
2537                                 /* NSEC proof did not work, try next */
2538                                 break;
2539                 }
2540
2541                 sec = nsec3_prove_nods(qstate->env, ve,
2542                         msg->rep->rrsets + msg->rep->an_numrrsets,
2543                         msg->rep->ns_numrrsets, qinfo, vq->key_entry, &reason);
2544                 switch(sec) {
2545                         case sec_status_insecure:
2546                                 /* case insecure also continues to unsigned
2547                                  * space.  If nsec3-iter-count too high or
2548                                  * optout, then treat below as unsigned */
2549                         case sec_status_secure:
2550                                 verbose(VERB_DETAIL, "NSEC3s for the "
2551                                         "referral proved no DS.");
2552                                 *ke = key_entry_create_null(qstate->region,
2553                                         qinfo->qname, qinfo->qname_len,
2554                                         qinfo->qclass, proof_ttl,
2555                                         *qstate->env->now);
2556                                 return (*ke) != NULL;
2557                         case sec_status_indeterminate:
2558                                 verbose(VERB_DETAIL, "NSEC3s for the "
2559                                   "referral proved no delegation");
2560                                 *ke = NULL;
2561                                 return 1;
2562                         case sec_status_bogus:
2563                                 verbose(VERB_DETAIL, "NSEC3s for the "
2564                                         "referral did not prove no DS.");
2565                                 errinf(qstate, reason);
2566                                 goto return_bogus;
2567                         case sec_status_unchecked:
2568                         default:
2569                                 /* NSEC3 proof did not work */
2570                                 break;
2571                 }
2572
2573                 /* Apparently, no available NSEC/NSEC3 proved NODATA, so
2574                  * this is BOGUS. */
2575                 verbose(VERB_DETAIL, "DS %s ran out of options, so return "
2576                         "bogus", val_classification_to_string(subtype));
2577                 errinf(qstate, "no DS but also no proof of that");
2578                 goto return_bogus;
2579         } else if(subtype == VAL_CLASS_CNAME ||
2580                 subtype == VAL_CLASS_CNAMENOANSWER) {
2581                 /* if the CNAME matches the exact name we want and is signed
2582                  * properly, then also, we are sure that no DS exists there,
2583                  * much like a NODATA proof */
2584                 enum sec_status sec;
2585                 struct ub_packed_rrset_key* cname;
2586                 cname = reply_find_rrset_section_an(msg->rep, qinfo->qname,
2587                         qinfo->qname_len, LDNS_RR_TYPE_CNAME, qinfo->qclass);
2588                 if(!cname) {
2589                         errinf(qstate, "validator classified CNAME but no "
2590                                 "CNAME of the queried name for DS");
2591                         goto return_bogus;
2592                 }
2593                 if(((struct packed_rrset_data*)cname->entry.data)->rrsig_count
2594                         == 0) {
2595                         if(msg->rep->an_numrrsets != 0 && ntohs(msg->rep->
2596                                 rrsets[0]->rk.type)==LDNS_RR_TYPE_DNAME) {
2597                                 errinf(qstate, "DS got DNAME answer");
2598                         } else {
2599                                 errinf(qstate, "DS got unsigned CNAME answer");
2600                         }
2601                         goto return_bogus;
2602                 }
2603                 sec = val_verify_rrset_entry(qstate->env, ve, cname,
2604                         vq->key_entry, &reason);
2605                 if(sec == sec_status_secure) {
2606                         verbose(VERB_ALGO, "CNAME validated, "
2607                                 "proof that DS does not exist");
2608                         /* and that it is not a referral point */
2609                         *ke = NULL;
2610                         return 1;
2611                 }
2612                 errinf(qstate, "CNAME in DS response was not secure.");
2613                 errinf(qstate, reason);
2614                 goto return_bogus;
2615         } else {
2616                 verbose(VERB_QUERY, "Encountered an unhandled type of "
2617                         "DS response, thus bogus.");
2618                 errinf(qstate, "no DS and");
2619                 if(FLAGS_GET_RCODE(msg->rep->flags) != LDNS_RCODE_NOERROR) {
2620                         char rc[16];
2621                         rc[0]=0;
2622                         (void)sldns_wire2str_rcode_buf((int)FLAGS_GET_RCODE(
2623                                 msg->rep->flags), rc, sizeof(rc));
2624                         errinf(qstate, rc);
2625                 } else  errinf(qstate, val_classification_to_string(subtype));
2626                 errinf(qstate, "message fails to prove that");
2627                 goto return_bogus;
2628         }
2629 return_bogus:
2630         *ke = key_entry_create_bad(qstate->region, qinfo->qname,
2631                 qinfo->qname_len, qinfo->qclass,
2632                 BOGUS_KEY_TTL, *qstate->env->now);
2633         return (*ke) != NULL;
2634 }
2635
2636 /**
2637  * Process DS response. Called from inform_supers.
2638  * Because it is in inform_supers, the mesh itself is busy doing callbacks
2639  * for a state that is to be deleted soon; don't touch the mesh; instead
2640  * set a state in the super, as the super will be reactivated soon.
2641  * Perform processing to determine what state to set in the super.
2642  *
2643  * @param qstate: query state that is validating and asked for a DS.
2644  * @param vq: validator query state
2645  * @param id: module id.
2646  * @param rcode: rcode result value.
2647  * @param msg: result message (if rcode is OK).
2648  * @param qinfo: from the sub query state, query info.
2649  * @param origin: the origin of msg.
2650  */
2651 static void
2652 process_ds_response(struct module_qstate* qstate, struct val_qstate* vq,
2653         int id, int rcode, struct dns_msg* msg, struct query_info* qinfo,
2654         struct sock_list* origin)
2655 {
2656         struct key_entry_key* dske = NULL;
2657         uint8_t* olds = vq->empty_DS_name;
2658         vq->empty_DS_name = NULL;
2659         if(!ds_response_to_ke(qstate, vq, id, rcode, msg, qinfo, &dske)) {
2660                         log_err("malloc failure in process_ds_response");
2661                         vq->key_entry = NULL; /* make it error */
2662                         vq->state = VAL_VALIDATE_STATE;
2663                         return;
2664         }
2665         if(dske == NULL) {
2666                 vq->empty_DS_name = regional_alloc_init(qstate->region,
2667                         qinfo->qname, qinfo->qname_len);
2668                 if(!vq->empty_DS_name) {
2669                         log_err("malloc failure in empty_DS_name");
2670                         vq->key_entry = NULL; /* make it error */
2671                         vq->state = VAL_VALIDATE_STATE;
2672                         return;
2673                 }
2674                 vq->empty_DS_len = qinfo->qname_len;
2675                 vq->chain_blacklist = NULL;
2676                 /* ds response indicated that we aren't on a delegation point.
2677                  * Keep the forState.state on FINDKEY. */
2678         } else if(key_entry_isgood(dske)) {
2679                 vq->ds_rrset = key_entry_get_rrset(dske, qstate->region);
2680                 if(!vq->ds_rrset) {
2681                         log_err("malloc failure in process DS");
2682                         vq->key_entry = NULL; /* make it error */
2683                         vq->state = VAL_VALIDATE_STATE;
2684                         return;
2685                 }
2686                 vq->chain_blacklist = NULL; /* fresh blacklist for next part*/
2687                 /* Keep the forState.state on FINDKEY. */
2688         } else if(key_entry_isbad(dske)
2689                 && vq->restart_count < VAL_MAX_RESTART_COUNT) {
2690                 vq->empty_DS_name = olds;
2691                 val_blacklist(&vq->chain_blacklist, qstate->region, origin, 1);
2692                 qstate->errinf = NULL;
2693                 vq->restart_count++;
2694         } else {
2695                 if(key_entry_isbad(dske)) {
2696                         errinf_origin(qstate, origin);
2697                         errinf_dname(qstate, "for DS", qinfo->qname);
2698                 }
2699                 /* NOTE: the reason for the DS to be not good (that is,
2700                  * either bad or null) should have been logged by
2701                  * dsResponseToKE. */
2702                 vq->key_entry = dske;
2703                 /* The FINDKEY phase has ended, so move on. */
2704                 vq->state = VAL_VALIDATE_STATE;
2705         }
2706 }
2707
2708 /**
2709  * Process DNSKEY response. Called from inform_supers.
2710  * Sets the key entry in the state.
2711  * Because it is in inform_supers, the mesh itself is busy doing callbacks
2712  * for a state that is to be deleted soon; don't touch the mesh; instead
2713  * set a state in the super, as the super will be reactivated soon.
2714  * Perform processing to determine what state to set in the super.
2715  *
2716  * @param qstate: query state that is validating and asked for a DNSKEY.
2717  * @param vq: validator query state
2718  * @param id: module id.
2719  * @param rcode: rcode result value.
2720  * @param msg: result message (if rcode is OK).
2721  * @param qinfo: from the sub query state, query info.
2722  * @param origin: the origin of msg.
2723  */
2724 static void
2725 process_dnskey_response(struct module_qstate* qstate, struct val_qstate* vq,
2726         int id, int rcode, struct dns_msg* msg, struct query_info* qinfo,
2727         struct sock_list* origin)
2728 {
2729         struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2730         struct key_entry_key* old = vq->key_entry;
2731         struct ub_packed_rrset_key* dnskey = NULL;
2732         int downprot;
2733         char* reason = NULL;
2734
2735         if(rcode == LDNS_RCODE_NOERROR)
2736                 dnskey = reply_find_answer_rrset(qinfo, msg->rep);
2737
2738         if(dnskey == NULL) {
2739                 /* bad response */
2740                 verbose(VERB_DETAIL, "Missing DNSKEY RRset in response to "
2741                         "DNSKEY query.");
2742                 if(vq->restart_count < VAL_MAX_RESTART_COUNT) {
2743                         val_blacklist(&vq->chain_blacklist, qstate->region,
2744                                 origin, 1);
2745                         qstate->errinf = NULL;
2746                         vq->restart_count++;
2747                         return;
2748                 }
2749                 vq->key_entry = key_entry_create_bad(qstate->region,
2750                         qinfo->qname, qinfo->qname_len, qinfo->qclass,
2751                         BOGUS_KEY_TTL, *qstate->env->now);
2752                 if(!vq->key_entry) {
2753                         log_err("alloc failure in missing dnskey response");
2754                         /* key_entry is NULL for failure in Validate */
2755                 }
2756                 errinf(qstate, "No DNSKEY record");
2757                 errinf_origin(qstate, origin);
2758                 errinf_dname(qstate, "for key", qinfo->qname);
2759                 vq->state = VAL_VALIDATE_STATE;
2760                 return;
2761         }
2762         if(!vq->ds_rrset) {
2763                 log_err("internal error: no DS rrset for new DNSKEY response");
2764                 vq->key_entry = NULL;
2765                 vq->state = VAL_VALIDATE_STATE;
2766                 return;
2767         }
2768         downprot = 1;
2769         vq->key_entry = val_verify_new_DNSKEYs(qstate->region, qstate->env,
2770                 ve, dnskey, vq->ds_rrset, downprot, &reason);
2771
2772         if(!vq->key_entry) {
2773                 log_err("out of memory in verify new DNSKEYs");
2774                 vq->state = VAL_VALIDATE_STATE;
2775                 return;
2776         }
2777         /* If the key entry isBad or isNull, then we can move on to the next
2778          * state. */
2779         if(!key_entry_isgood(vq->key_entry)) {
2780                 if(key_entry_isbad(vq->key_entry)) {
2781                         if(vq->restart_count < VAL_MAX_RESTART_COUNT) {
2782                                 val_blacklist(&vq->chain_blacklist,
2783                                         qstate->region, origin, 1);
2784                                 qstate->errinf = NULL;
2785                                 vq->restart_count++;
2786                                 vq->key_entry = old;
2787                                 return;
2788                         }
2789                         verbose(VERB_DETAIL, "Did not match a DS to a DNSKEY, "
2790                                 "thus bogus.");
2791                         errinf(qstate, reason);
2792                         errinf_origin(qstate, origin);
2793                         errinf_dname(qstate, "for key", qinfo->qname);
2794                 }
2795                 vq->chain_blacklist = NULL;
2796                 vq->state = VAL_VALIDATE_STATE;
2797                 return;
2798         }
2799         vq->chain_blacklist = NULL;
2800         qstate->errinf = NULL;
2801
2802         /* The DNSKEY validated, so cache it as a trusted key rrset. */
2803         key_cache_insert(ve->kcache, vq->key_entry, qstate);
2804
2805         /* If good, we stay in the FINDKEY state. */
2806         log_query_info(VERB_DETAIL, "validated DNSKEY", qinfo);
2807 }
2808
2809 /**
2810  * Process prime response
2811  * Sets the key entry in the state.
2812  *
2813  * @param qstate: query state that is validating and primed a trust anchor.
2814  * @param vq: validator query state
2815  * @param id: module id.
2816  * @param rcode: rcode result value.
2817  * @param msg: result message (if rcode is OK).
2818  * @param origin: the origin of msg.
2819  */
2820 static void
2821 process_prime_response(struct module_qstate* qstate, struct val_qstate* vq,
2822         int id, int rcode, struct dns_msg* msg, struct sock_list* origin)
2823 {
2824         struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2825         struct ub_packed_rrset_key* dnskey_rrset = NULL;
2826         struct trust_anchor* ta = anchor_find(qstate->env->anchors,
2827                 vq->trust_anchor_name, vq->trust_anchor_labs,
2828                 vq->trust_anchor_len, vq->qchase.qclass);
2829         if(!ta) {
2830                 /* trust anchor revoked, restart with less anchors */
2831                 vq->state = VAL_INIT_STATE;
2832                 if(!vq->trust_anchor_name)
2833                         vq->state = VAL_VALIDATE_STATE; /* break a loop */
2834                 vq->trust_anchor_name = NULL;
2835                 return;
2836         }
2837         /* Fetch and validate the keyEntry that corresponds to the
2838          * current trust anchor. */
2839         if(rcode == LDNS_RCODE_NOERROR) {
2840                 dnskey_rrset = reply_find_rrset_section_an(msg->rep,
2841                         ta->name, ta->namelen, LDNS_RR_TYPE_DNSKEY,
2842                         ta->dclass);
2843         }
2844         if(ta->autr) {
2845                 if(!autr_process_prime(qstate->env, ve, ta, dnskey_rrset)) {
2846                         /* trust anchor revoked, restart with less anchors */
2847                         vq->state = VAL_INIT_STATE;
2848                         vq->trust_anchor_name = NULL;
2849                         return;
2850                 }
2851         }
2852         vq->key_entry = primeResponseToKE(dnskey_rrset, ta, qstate, id);
2853         lock_basic_unlock(&ta->lock);
2854         if(vq->key_entry) {
2855                 if(key_entry_isbad(vq->key_entry)
2856                         && vq->restart_count < VAL_MAX_RESTART_COUNT) {
2857                         val_blacklist(&vq->chain_blacklist, qstate->region,
2858                                 origin, 1);
2859                         qstate->errinf = NULL;
2860                         vq->restart_count++;
2861                         vq->key_entry = NULL;
2862                         vq->state = VAL_INIT_STATE;
2863                         return;
2864                 }
2865                 vq->chain_blacklist = NULL;
2866                 errinf_origin(qstate, origin);
2867                 errinf_dname(qstate, "for trust anchor", ta->name);
2868                 /* store the freshly primed entry in the cache */
2869                 key_cache_insert(ve->kcache, vq->key_entry, qstate);
2870         }
2871
2872         /* If the result of the prime is a null key, skip the FINDKEY state.*/
2873         if(!vq->key_entry || key_entry_isnull(vq->key_entry) ||
2874                 key_entry_isbad(vq->key_entry)) {
2875                 vq->state = VAL_VALIDATE_STATE;
2876         }
2877         /* the qstate will be reactivated after inform_super is done */
2878 }
2879
2880 /**
2881  * Process DLV response. Called from inform_supers.
2882  * Because it is in inform_supers, the mesh itself is busy doing callbacks
2883  * for a state that is to be deleted soon; don't touch the mesh; instead
2884  * set a state in the super, as the super will be reactivated soon.
2885  * Perform processing to determine what state to set in the super.
2886  *
2887  * @param qstate: query state that is validating and asked for a DLV.
2888  * @param vq: validator query state
2889  * @param id: module id.
2890  * @param rcode: rcode result value.
2891  * @param msg: result message (if rcode is OK).
2892  * @param qinfo: from the sub query state, query info.
2893  */
2894 static void
2895 process_dlv_response(struct module_qstate* qstate, struct val_qstate* vq,
2896         int id, int rcode, struct dns_msg* msg, struct query_info* qinfo)
2897 {
2898         struct val_env* ve = (struct val_env*)qstate->env->modinfo[id];
2899
2900         verbose(VERB_ALGO, "process dlv response to super");
2901         if(rcode != LDNS_RCODE_NOERROR) {
2902                 /* lookup failed, set in vq to give up */
2903                 vq->dlv_status = dlv_error;
2904                 verbose(VERB_ALGO, "response is error");
2905                 return;
2906         }
2907         if(msg->rep->security != sec_status_secure) {
2908                 vq->dlv_status = dlv_error;
2909                 verbose(VERB_ALGO, "response is not secure, %s",
2910                         sec_status_to_string(msg->rep->security));
2911                 return;
2912         }
2913         /* was the lookup a success? validated DLV? */
2914         if(FLAGS_GET_RCODE(msg->rep->flags) == LDNS_RCODE_NOERROR &&
2915                 msg->rep->an_numrrsets == 1 &&
2916                 msg->rep->security == sec_status_secure &&
2917                 ntohs(msg->rep->rrsets[0]->rk.type) == LDNS_RR_TYPE_DLV &&
2918                 ntohs(msg->rep->rrsets[0]->rk.rrset_class) == qinfo->qclass &&
2919                 query_dname_compare(msg->rep->rrsets[0]->rk.dname,
2920                         vq->dlv_lookup_name) == 0) {
2921                 /* yay! it is just like a DS */
2922                 vq->ds_rrset = (struct ub_packed_rrset_key*)
2923                         regional_alloc_init(qstate->region,
2924                         msg->rep->rrsets[0], sizeof(*vq->ds_rrset));
2925                 if(!vq->ds_rrset) {
2926                         log_err("out of memory in process_dlv");
2927                         return;
2928                 }
2929                 vq->ds_rrset->entry.key = vq->ds_rrset;
2930                 vq->ds_rrset->rk.dname = (uint8_t*)regional_alloc_init(
2931                         qstate->region, vq->ds_rrset->rk.dname,
2932                         vq->ds_rrset->rk.dname_len);
2933                 if(!vq->ds_rrset->rk.dname) {
2934                         log_err("out of memory in process_dlv");
2935                         vq->dlv_status = dlv_error;
2936                         return;
2937                 }
2938                 vq->ds_rrset->entry.data = regional_alloc_init(qstate->region,
2939                         vq->ds_rrset->entry.data,
2940                         packed_rrset_sizeof(vq->ds_rrset->entry.data));
2941                 if(!vq->ds_rrset->entry.data) {
2942                         log_err("out of memory in process_dlv");
2943                         vq->dlv_status = dlv_error;
2944                         return;
2945                 }
2946                 packed_rrset_ptr_fixup(vq->ds_rrset->entry.data);
2947                 /* make vq do a DNSKEY query next up */
2948                 vq->dlv_status = dlv_success;
2949                 return;
2950         }
2951         /* store NSECs into negative cache */
2952         val_neg_addreply(ve->neg_cache, msg->rep);
2953
2954         /* was the lookup a failure?
2955          *   if we have to go up into the DLV for a higher DLV anchor
2956          *   then set this in the vq, so it can make queries when activated.
2957          * See if the NSECs indicate that we should look for higher DLV
2958          * or, that there is no DLV securely */
2959         if(!val_nsec_check_dlv(qinfo, msg->rep, &vq->dlv_lookup_name,
2960                 &vq->dlv_lookup_name_len)) {
2961                 vq->dlv_status = dlv_error;
2962                 verbose(VERB_ALGO, "nsec error");
2963                 return;
2964         }
2965         if(!dname_subdomain_c(vq->dlv_lookup_name,
2966                 qstate->env->anchors->dlv_anchor->name)) {
2967                 vq->dlv_status = dlv_there_is_no_dlv;
2968                 return;
2969         }
2970         vq->dlv_status = dlv_ask_higher;
2971 }
2972
2973 /*
2974  * inform validator super.
2975  *
2976  * @param qstate: query state that finished.
2977  * @param id: module id.
2978  * @param super: the qstate to inform.
2979  */
2980 void
2981 val_inform_super(struct module_qstate* qstate, int id,
2982         struct module_qstate* super)
2983 {
2984         struct val_qstate* vq = (struct val_qstate*)super->minfo[id];
2985         log_query_info(VERB_ALGO, "validator: inform_super, sub is",
2986                 &qstate->qinfo);
2987         log_query_info(VERB_ALGO, "super is", &super->qinfo);
2988         if(!vq) {
2989                 verbose(VERB_ALGO, "super: has no validator state");
2990                 return;
2991         }
2992         if(vq->wait_prime_ta) {
2993                 vq->wait_prime_ta = 0;
2994                 process_prime_response(super, vq, id, qstate->return_rcode,
2995                         qstate->return_msg, qstate->reply_origin);
2996                 return;
2997         }
2998         if(qstate->qinfo.qtype == LDNS_RR_TYPE_DS) {
2999                 process_ds_response(super, vq, id, qstate->return_rcode,
3000                         qstate->return_msg, &qstate->qinfo,
3001                         qstate->reply_origin);
3002                 return;
3003         } else if(qstate->qinfo.qtype == LDNS_RR_TYPE_DNSKEY) {
3004                 process_dnskey_response(super, vq, id, qstate->return_rcode,
3005                         qstate->return_msg, &qstate->qinfo,
3006                         qstate->reply_origin);
3007                 return;
3008         } else if(qstate->qinfo.qtype == LDNS_RR_TYPE_DLV) {
3009                 process_dlv_response(super, vq, id, qstate->return_rcode,
3010                         qstate->return_msg, &qstate->qinfo);
3011                 return;
3012         }
3013         log_err("internal error in validator: no inform_supers possible");
3014 }
3015
3016 void
3017 val_clear(struct module_qstate* qstate, int id)
3018 {
3019         if(!qstate)
3020                 return;
3021         /* everything is allocated in the region, so assign NULL */
3022         qstate->minfo[id] = NULL;
3023 }
3024
3025 size_t
3026 val_get_mem(struct module_env* env, int id)
3027 {
3028         struct val_env* ve = (struct val_env*)env->modinfo[id];
3029         if(!ve)
3030                 return 0;
3031         return sizeof(*ve) + key_cache_get_mem(ve->kcache) +
3032                 val_neg_get_mem(ve->neg_cache) +
3033                 sizeof(size_t)*2*ve->nsec3_keyiter_count;
3034 }
3035
3036 /**
3037  * The validator function block
3038  */
3039 static struct module_func_block val_block = {
3040         "validator",
3041         &val_init, &val_deinit, &val_operate, &val_inform_super, &val_clear,
3042         &val_get_mem
3043 };
3044
3045 struct module_func_block*
3046 val_get_funcblock(void)
3047 {
3048         return &val_block;
3049 }
3050
3051 const char*
3052 val_state_to_string(enum val_state state)
3053 {
3054         switch(state) {
3055                 case VAL_INIT_STATE: return "VAL_INIT_STATE";
3056                 case VAL_FINDKEY_STATE: return "VAL_FINDKEY_STATE";
3057                 case VAL_VALIDATE_STATE: return "VAL_VALIDATE_STATE";
3058                 case VAL_FINISHED_STATE: return "VAL_FINISHED_STATE";
3059                 case VAL_DLVLOOKUP_STATE: return "VAL_DLVLOOKUP_STATE";
3060         }
3061         return "UNKNOWN VALIDATOR STATE";
3062 }
3063